CVE-2026-57156 is a critical (CVSS 9.8) integer overflow in FreeRDP clients before version 3.28.0, on 32-bit builds. A malicious RDP server can trigger a heap overflow in the client. Upgrade to 3.28.0 or later, starting with any 32-bit builds you run.
What's affected
The FreeRDP advisory (GHSA-v5wf-j8j4-77h7) says versions up to 3.27.1 are affected and 3.28.0 is patched. It applies to FreeRDP based clients on 32-bit builds only, where the size type is a 32-bit unsigned value.
The flaw is in update_read_delta_points in libfreerdp/core/orders.c. A point count from the network is multiplied by the size of a point structure before memory is allocated. On 32-bit builds, a large count makes the product wrap around, so the buffer is too small, and a later write goes past its end.
The attacker is the remote desktop server, or something that sits between you and it. The risk falls on people who connect to servers they do not trust.
How to check if you're exposed
Check the FreeRDP version and architecture.
xfreerdp /version
file $(which xfreerdp)
- A version of 3.27.1 or lower is in scope, and only on 32-bit builds.
- FreeRDP is embedded in many clients, including Remmina and other remote desktop tools. Check each tool's own version and the FreeRDP library it bundles or links.
- Check ARM and older embedded devices, since 32-bit builds are common there.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade FreeRDP to 3.28.0 or later, or install your distribution's patched package.
- Update tools that bundle FreeRDP, and rebuild images that include it.
- Find 32-bit builds first, since they are the only affected ones.
- Connect only to RDP servers you trust, until you have updated.
- Prefer 64-bit builds where you have the choice.
Why it matters
The record lists CWE-190, integer overflow or wraparound, and CWE-122, heap based buffer overflow. The classic pattern: a number from the network is multiplied by a size, the multiplication wraps, and the program allocates less memory than it later uses.
A related FreeRDP pull request notes that an overflow guard was written the wrong way round and was reordered so the bound sits on the count itself. Even a check that looks present needs a test, and fuzzing finds these. The high score reflects a network attack with no user action. The reach is limited to 32-bit clients. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Are 64-bit builds affected?
The advisory says 32-bit builds only, where the size type is 32 bits wide. Upgrade anyway, because 3.28.0 also fixes other issues.
Sources
Last reviewed: 19 October 2026.
