Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2021-41159: FreeRDP Clients Before 2.4.1 May Allow Memory Corruption
CVE-2021-41159 · published 5 years ago
Summary
FreeRDP clients before version 2.4.1 have a security weakness when using gateway connections. If you use an outdated version, a malicious gateway could potentially damage your computer's memory. Update to the latest version (2.4.1) or use a different connection method if an update isn't possible.
What to do
- Update freerdp freerdp to version 2.4.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freerdp | freerdp |
< 2.4.1 cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* |
| fedoraproject | fedora |
35 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
Original advisory text
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to va...
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published21 Oct 2021
Updated31 Oct 2026
First seen11 Apr 2026
Track software like this
Free during beta