{"id":"CVE-2025-68118","title":"FreeRDP is a free implementation of the Remote Desktop Protocol","summary":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function `freerdp_certificate_data_hash_ uses` the Microsof…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"freerdp","product":"freerdp","affected":["freerdp < 3.20.0"],"patched":["freerdp 3.20.0"],"published":"2025-12-17","updated":"2026-10-13","sourceUpdated":"2026-10-13T11:10:00.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68118","references":[{"url":"https://github.com/FreeRDP/FreeRDP/commit/a0b21f992a9de1de2468fc9e600aa2b7a4066307","label":"security-advisories@github.com"},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h78c-5cjx-jw6x","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00244,"epssPercentile":0.14452,"ingestedAt":"2026-10-13T11:23:51.129Z","slug":"CVE-2025-68118","body":"## Overview\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function `freerdp_certificate_data_hash_ uses` the Microsoft-specific `_snprintf` function to format certificate cache filenames without guaranteeing NUL termination when truncation occurs. According to Microsoft documentation, `_snprintf` does not append a terminating NUL byte if the formatted output exceeds the destination buffer size. If an attacker controls the hostname value (for example via server redirection or a crafted .rdp file), the resulting filename buffer may not be NUL-terminated. Subsequent string operations performed on this buffer may read beyond the allocated memory region, resulting in a heap-based out-of-bounds read. In default configurations, the connection is typically terminated before sensitive data can be meaningfully exposed, but unintended memory read or a client crash may still occur under certain conditions. Version 3.20.0 has a patch for the issue.\n\n## Affected\n\n- `freerdp < 3.20.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `freerdp 3.20.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}