Read the docs
TI-2021-17999 Aliases CVE-2021-41160

Improper region checks in FreeRDP allow out of bound write to memory

Priority MEDIUM 41CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.

Why it matters now

EPSS 0.01662 76th percentileScored 2026-11-07
Fix Fixed FreeRDP (FreeRDP): 2.4.1Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeRDPFreeRDPbefore 2.4.12.4.1Patch availableCNA
  • FreeRDP VendorFreeRDP Affected before 2.4.1 Fixed in 2.4.1 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*before 2.4.1VulnerableFreeRDP
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·FreeRDP
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA FreeRDP (FreeRDP) Fixed in 2.4.1

Red Hat 5 advisories

  • RHSA-2021:4619 Released 2021-11-11 · Red Hat rating Important
    freerdp security update
    • Red Hat Enterprise Linux Client (v. 7) freerdp-2.1.1-5.el7_9, freerdp-libs-2.1.1-5.el7_9, libwinpr-2.1.1-5.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) freerdp-devel-2.1.1-5.el7_9, libwinpr-devel-2.1.1-5.el7_9
    • Red Hat Enterprise Linux Server (v. 7) freerdp-2.1.1-5.el7_9, freerdp-libs-2.1.1-5.el7_9, freerdp-libs-2.1.1-5.el7_9.ppc +2
    • Red Hat Enterprise Linux Server Optional (v. 7) freerdp-devel-2.1.1-5.el7_9, freerdp-devel-2.1.1-5.el7_9.ppc, libwinpr-devel-2.1.1-5.el7_9 +1
    • Red Hat Enterprise Linux Workstation (v. 7) freerdp-2.1.1-5.el7_9, freerdp-libs-2.1.1-5.el7_9, libwinpr-2.1.1-5.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) freerdp-devel-2.1.1-5.el7_9, libwinpr-devel-2.1.1-5.el7_9
  • RHSA-2021:4623 Released 2021-11-11 · Red Hat rating Important
    freerdp security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) freerdp-2:2.2.0-6.el8_4, freerdp-libs-2:2.2.0-6.el8_4, libwinpr-2:2.2.0-6.el8_4 +1
    • Red Hat Enterprise Linux CRB EUS (v.8.4) freerdp-devel-2:2.2.0-6.el8_4
  • RHSA-2021:4621 Released 2021-11-11 · Red Hat rating Important
    freerdp security update
    • Red Hat CodeReady Linux Builder EUS (v. 8.2) freerdp-devel-2:2.0.0-46.rc4.el8_2.5
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) freerdp-2:2.0.0-46.rc4.el8_2.5, freerdp-libs-2:2.0.0-46.rc4.el8_2.5, libwinpr-2:2.0.0-46.rc4.el8_2.5 +1
Show 2 more Red Hat advisories
  • RHSA-2021:4622 Released 2021-11-11 · Red Hat rating Important
    freerdp security update
    • Red Hat CodeReady Linux Builder (v. 8) freerdp-devel-2:2.2.0-7.el8_5
    • Red Hat Enterprise Linux AppStream (v. 8) freerdp-2:2.2.0-7.el8_5, freerdp-libs-2:2.2.0-7.el8_5, libwinpr-2:2.2.0-7.el8_5 +1
  • RHSA-2021:4620 Released 2021-11-11 · Red Hat rating Important
    freerdp security update
    • Red Hat CodeReady Linux Builder EUS (v. 8.1) freerdp-devel-2:2.0.0-46.rc4.el8_1.5
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) freerdp-2:2.0.0-46.rc4.el8_1.5, freerdp-libs-2:2.0.0-46.rc4.el8_1.5, libwinpr-2:2.0.0-46.rc4.el8_1.5 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    FreeRDP — FEDORA-2021-2c25f03d0b

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-17998 Improper client input validation for FreeRDP gateway connections allows to overwrite memoryPriority MEDIUM 41
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:4622
Red Hat CodeReady Linux Builder EUS (v. 8.1)Fixed RHSA-2021:4620
Red Hat CodeReady Linux Builder EUS (v. 8.2)Fixed RHSA-2021:4621
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:4622
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:4620
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:4621
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2021:4623
Red Hat Enterprise Linux CRB EUS (v.8.4)Fixed RHSA-2021:4623
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2021:4619
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:4619
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:4619
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:4619
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:4619
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:4619
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41160

References

Advisory 5

Other 1

  • TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
  • TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
  • TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
  • TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
  • TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
  • TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
See all 336 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences