Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-67290

Fixed in a distro release EPSS <1%CVSS 7.5

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.

Published 2026-08-01 · CVE record · OSV

Products: FreeRDP

Distro releases

ReleasePackageFixed in
Debian 12freerdp2no fix
Debian 13freerdp3no fix
Debian 14freerdp33.29.0+dfsg-1
Red Hat Enterprise Linux eus 10.0freerdp2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-debuginfo2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-debugsource2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-devel2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-libs2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-libs-debuginfo2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-server2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0freerdp-server-debuginfo2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0libwinpr2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0libwinpr-debuginfo2:3.10.3-3.el10_0.16
Red Hat Enterprise Linux eus 10.0libwinpr-devel2:3.10.3-3.el10_0.16
Red Hat rhel els 7freerdp0:2.1.1-5.el7_9.12
Red Hat rhel els 7freerdp-debuginfo0:2.1.1-5.el7_9.12
Red Hat rhel els 7freerdp-devel0:2.1.1-5.el7_9.12
Red Hat rhel els 7freerdp-libs0:2.1.1-5.el7_9.12
Red Hat rhel els 7libwinpr0:2.1.1-5.el7_9.12
Red Hat rhel els 7libwinpr-devel0:2.1.1-5.el7_9.12
Ubuntu 16.04 LTSfreerdpno fix
Ubuntu 18.04 LTSfreerdpno fix
Ubuntu 22.04 LTSfreerdp2no fix
Ubuntu 24.04 LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1
Ubuntu 26.04 LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1
Ubuntu Pro 18.04 LTSfreerdp2no fix
Ubuntu Pro 20.04 LTSfreerdp2no fix
Ubuntu Pro 24.04 LTSfreerdp2no fix