Read the docs
TI-2017-02056 Aliases CVE-2017-2835GHSA-vrw2-cvcm-cjpq

Out-of-bounds write in FreeRDP

Priority LOW 38CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to trigger this vulnerability.

Why it matters now

EPSS 0.01433 73rd percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeRDPFreeRDP2.0.0-beta1+android11 - Windows, OSX, Linux—No fix listedCNA
  • FreeRDP VendorFreeRDP Affected 2.0.0-beta1+android11 - Windows, OSX, Linux Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:freerdp:freerdp:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1VulnerableFreeRDP
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:freerdp:freerdp:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·FreeRDP
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    FreeRDP — DSA-3923

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2017-02055 Out-of-bounds write in FreeRDPPriority LOW 34
    • TI-2017-02060 An exploitable denial of service vulnerability exists within the handling of challenge…Priority LOW 30
    • TI-2017-02059 Integer overflow in FreeRDPPriority LOW 30
    Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2835
  2. 2026-10-03 Alias added: GHSA-vrw2-cvcm-cjpq

References

Advisory 2

  • TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
  • TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
  • TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
  • TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
  • TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
  • TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
See all 336 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences