FreeRDP 3.31.0 Fixes 22 Security Flaws Including Heap Overflow and Pre-Auth DoS Bugs

FreeRDP version 3.31.0 has been released as a significant security and stability update, addressing 22 disclosed security vulnerabilities in the widely used open-source implementation of the Remote Desktop Protocol (RDP).

Project maintainers have termed this release a “huge bug fix and security release” and strongly encourage distributors to update promptly due to the serious nature of the issues resolved.

This release is particularly important for organizations that package FreeRDP for Linux desktops, thin clients, gateways, application servers, embedded systems, or remote-access tools.

FreeRDP 3.31.0 Fixes 22 Security Flaws

The update includes fixes for memory-safety defects such as a heap overflow, as well as pre-authentication denial-of-service vulnerabilities that could be exploited before a user completes the RDP login process.

This distinction elevates the operational priority: pre-authentication vulnerabilities may allow an unauthenticated user to disrupt an exposed service, while memory corruption flaws could lead to more severe risks, such as crashes or code execution, depending on the specific component affected, the potential for exploitation, and the runtime mitigations in place. FreeRDP did not detail all the identified issues in the release announcement.

FreeRDP functions as both a client and server implementation of RDP, incorporating various components for protocol negotiation, Network Level Authentication (NLA), graphics codecs, virtual channels, device redirection, smart card support, audio, clipboard sharing, and gateway communications.

A vulnerability in any of these components can become security-critical when a client connects to a malicious server, a server accepts untrusted connections, or a proxy processes attacker-controlled RDP traffic. Therefore, the scope of the fixes extends beyond just desktop clients.

Among the enhancements made in this release, the project bounded AVC444v2 chroma processing to the decoded frame width, limited copying of NTLM data to the smaller input entity, required a 16-byte signature buffer before access, and limited the RDP Gateway authorization tunnel response to the received length.

The update also addressed use-after-free conditions linked to printer drivers, improved reallocation management, added null checks, strengthened stream validation, and resolved race conditions in RAIL and dynamic channel processing. These changes emphasize the importance of input-length validation and overall memory hygiene.

Version 3.31.0 also brings improvements in performance and compatibility. The maintainers reported that optimizing the YUV decoder should enhance client graphics in AVC/H.264 sessions.

Additionally, the build expands hardware decoder support and utilizes dav1d for AV1 decoding. Other fixes address issues such as OpenSSL BIO/SSL creation failures, TLS AEAD data limit configurations, Android clipboard behavior, excessive CPU usage in the SDL client, and build path issues for OpenBSD, Cygwin, MinGW, and BSD systems.

This combination of updates makes the release more than just a narrowly focused security patch for production environments.

Administrators should identify all installed FreeRDP packages, including libraries bundled with remote-access products, and obtain the updated versions from their operating system distributor or the official project release channel.

Upgrade testing should focus on internet-facing RDP gateways, shared workstations, virtualization consoles, and systems that utilize redirection features or H.264/AVC graphics.

If immediate updates are unavailable, reduce exposure by implementing network segmentation, using VPNs or zero-trust access controls, employing allowlisting, and maintaining continuous monitoring and triage for any RDP service crashes or unusual connection attempts.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.