CVE-2025-68118 is an out-of-bounds read in FreeRDP before 3.20.0 on Windows, scored critical (CVSS 9.1) in the record. A long hostname can leave a filename buffer without a terminator. The fix is 3.20.0, and the project advisory rates it low.
What's affected
FreeRDP versions before 3.20.0, on Windows. The GitHub advisory lists 3.19.1 and earlier as affected and 3.20.0 as patched, and names the fix commit a0b21f992a9de1de2468fc9e600aa2b7a4066307. The issue is in the Windows certificate handling code.
Severity differs a lot. The NVD record shows 9.1, critical. The project's own advisory rates it low. The advisory explains why: in default configurations, the connection is typically terminated before sensitive data can be meaningfully exposed, though an unintended memory read or a client crash may occur under certain conditions. This post gives both ratings and recommends planning against the project's own description of impact.
How to check if you're exposed
FreeRDP is a library and a client. Find the version in your tools:
xfreerdp /version
wfreerdp.exe /version
On Windows, also check which applications bundle the FreeRDP libraries, such as remote desktop clients, orchestration tools and virtual desktop software. Look for freerdp DLL files and read their version information:
Get-ChildItem -Recurse -Filter "freerdp*.dll" C:\ -ErrorAction SilentlyContinue | Select-Object FullName, @{n="Version";e={$_.VersionInfo.FileVersion}}
Linux and macOS builds are not in the described path, because the issue comes from a Windows specific function.
What to do now
- List Windows applications that include FreeRDP.
- Update to FreeRDP 3.20.0 or later, or to an application release that bundles it.
- Avoid opening .rdp files from unknown sources.
- Treat server redirection from untrusted hosts with caution.
- Record the severity disagreement in your ticket so reviewers see both ratings.
Why it matters
The weakness is CWE-125, out-of-bounds read. The advisory says the Windows function _snprintf does not add a terminating NUL byte when the output is longer than the buffer. If an attacker controls the hostname, for example through server redirection or a crafted .rdp file, later string handling can read past the buffer.
It is a platform specific C pitfall: the same code that is safe with the standard snprintf is unsafe with a Microsoft specific variant. A read overrun like this usually causes a crash or a small leak, not code execution, which is why the project rates it low while the base score is high. The record does not list this CVE as known exploited.
Quick check
Why do the ratings differ so much?
The NVD record says 9.1 and the project says low. The project notes that connections are typically terminated before data is exposed. Plan on the project impact description, and still patch.
Does this affect Linux clients?
The advisory says the problem is in Windows certificate handling code, so Linux builds are not described as affected.
Sources
Last reviewed: 18 October 2026.
