CVE-2026-57156— FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-57156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57156
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57156 (3)
Vendor Advisories for CVE-2026-57156 (1)
Same Patch Batch · FreeRDP · 2026-07-10 · 4 CVEs total
| CVE-2026-55827 | 7.5 HIGH | FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode |
| CVE-2026-57157 | 6.5 MEDIUM | Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated Devic |
| CVE-2026-57158 | FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-2353 |
IV. Related Vulnerabilities
Same product: FreeRDP
- CVE-2026-57157
Out-of-bounds read in the camera device enumerator server (r - CVE-2026-57158
FreeRDP planar_decompress_plane_rle_only: heap OOB read — in - CVE-2026-55827
FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bi - CVE-2026-56297
FreeRDP - Use-After-Free via Race Condition in DRDYNVC Chann - CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder
Same vendor: FreeRDP
- CVE-2026-57157
Out-of-bounds read in the camera device enumerator server (r - CVE-2026-57158
FreeRDP planar_decompress_plane_rle_only: heap OOB read — in - CVE-2026-55827
FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bi - CVE-2026-56297
FreeRDP - Use-After-Free via Race Condition in DRDYNVC Chann - CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder
Same weakness: CWE-122
- CVE-2026-54000
osquery: Heap buffer overflow in `getProcessCurrentDirectory - CVE-2026-54001
osquery: Heap buffer overflow via `authenticode` table (Wind - CVE-2026-15182
GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow - CVE-2026-58306
Samsung Escargot堆缓冲区溢出漏洞 - CVE-2026-15174
Heap-based Buffer Overflow in Wireshark
V. Comments for CVE-2026-57156
No comments yet