Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

FreeRDP bug bounty programs

freerdp.com Updated

FreeRDP runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program FreeRDP runs.

  • FreeRDP

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 6 excluded.

  • https://www.freerdp.com

    Web

  • Certificate handling and the trust store, including how a changed or unverifiable server certificate is presented to the user

    Products and areas

  • Every graphics codec: RemoteFX, NSCodec, the progressive codec, planar and interleaved bitmap compression, ZGFX and the whole GFX pipeline

    Products and areas

  • SECURITY.md offers two private channels and describes a triage process running to affected-version analysis and a CVE request. It draws no boundary narrower than the FreeRDP tree, so the library, the server implementation and every tool built from the repository are in

    Products and areas

  • The client binaries the project ships, xfreerdp, the Wayland client and the SDL client, plus their command-line and configuration handling

    Products and areas

  • The proxy component, which sits between two RDP parties and parses both directions

    Products and areas

  • The RDP connection sequence in full: X.224, MCS, the capability exchange and everything parsed before a session is established

    Products and areas

  • The security layers, covering legacy RDP encryption, TLS, CredSSP and NLA, along with the NTLM and Kerberos implementations behind them

    Products and areas

  • The server-side implementation and the shadow server, which accept connections from untrusted clients

    Products and areas

  • The virtual channel framework and each channel shipped with it, covering clipboard, drive redirection, printing, smartcard, audio output and input, RAIL, video redirection, serial and parallel ports and USB

    Products and areas

  • WinPR, the portability layer, including its SSPI, cryptography, registry, string and synchronisation code, which is reachable from parsing paths above it

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A user clicking through a certificate warning the client displayed correctly

  • Bugs in Remmina, Apache Guacamole, Proxmox or another downstream product's own code rather than in FreeRDP

  • Microsoft's RDP protocol design, as opposed to a defect in this implementation of it

  • Reports against an unsupported branch when the same code path is already fixed upstream

  • Upstream library defects in OpenSSL, FFmpeg or similar, unless FreeRDP's own use of them is what makes the bug reachable

  • Vendor forks of FreeRDP embedded in appliances rather than the upstream repository

Recent changes

Reward and scope changes across every FreeRDP program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in FreeRDP products, from the NVD.

Search NVD
  • CVE-2026-121963 High

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.

  • CVE-2026-121964 High

    FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and

  • CVE-2026-121958 High

    FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PD

  • CVE-2026-121959 High

    FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.

  • CVE-2026-121960 High

    FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process.

  • CVE-2026-121961 High

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.

  • CVE-2026-121962 High

    FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service.

  • CVE-2026-121952 Critical

    FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a cras

About this page

This page gathers every public program listed under freerdp.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.