---
id: CVE-2026-57156
title: FreeRDP is a free implementation of the Remote Desktop Protocol
summary: >-
  FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to
  3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in
  update_read_delta_points in libfreerdp/core/orders.c when multiplying an
  attacker-controlle…
severity: none
cwe:
  - CWE-122
  - CWE-190
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57156'
references:
  - url: >-
      https://github.com/FreeRDP/FreeRDP/commit/487f35daccb36a6224e530dcd8fa60850825f823
    label: security-advisories@github.com
  - url: 'https://github.com/FreeRDP/FreeRDP/pull/12938'
    label: security-advisories@github.com
  - url: 'https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0'
    label: security-advisories@github.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00698
epssPercentile: 0.51072
ingestedAt: '2026-07-11T20:15:26.736Z'
---

## Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.