Read the docs
TI-2020-11878 Aliases CVE-2020-15103

Integer Overflow in FreeRDP

Priority LOW 20CWE-680Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto

Why it matters now

EPSS 0.01459 73rd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeRDPFreeRDPup to 2.1.2—No fix listedCNA
  • FreeRDP VendorFreeRDP Affected up to 2.1.2 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*up to 2.1.2VulnerableFreeRDP
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* Versions up to 2.1.2 Vulnerable ·FreeRDP
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Red Hat 1 advisory

  • RHSA-2021:1849 Released 2021-05-18 · Red Hat rating Moderate
    freerdp security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) freerdp-devel-2:2.2.0-1.el8
    • Red Hat Enterprise Linux AppStream (v. 8) freerdp-2:2.2.0-1.el8, freerdp-libs-2:2.2.0-1.el8, libwinpr-2:2.2.0-1.el8 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:1849
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:1849
Not affected: 1 product
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15103

References

Patch 1

Advisory 7

  • TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
  • TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
  • TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
  • TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
  • TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
  • TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
See all 336 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences