FreeRDP

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 109 Last 12 months 190 Lifetime Memory safety 55 % Parsing/validation 25 % Denial of service 12 % Info disclosure 8 % Latest advisories Loading the feed Overview FreeRDP is how everything that is not Windows speaks RDP. It is the client engine under Apache Guacamole, Remmina, GNOME Connections, Proxmox consoles and Microsoft's own Windows App on Linux, so one library stands between an untrusted RDP server and a very large number of client machines. The cost of a bug here is a connection to a hostile server taking over the machine that opened it. The record says that surface keeps yielding: 109 advisories in the last twelve months out of 190 published ever, the busiest pipeline in this category. None of them paid anything, so sorona.xyz pays you directly on qualified, reproduced findings. In scope SECURITY.md offers two private channels and describes a triage process running to affected-version analysis and a CVE request. It draws no boundary narrower than the FreeRDP tree, so the library, the server implementation and every tool built from the repository are in The RDP connection sequence in full: X.224, MCS, the capability exchange and everything parsed before a session is established The security layers, covering legacy RDP encryption, TLS, CredSSP and NLA, along with the NTLM and Kerberos implementations behind them Certificate handling and the trust store, including how a changed or unverifiable server certificate is presented to the user Every graphics codec: RemoteFX, NSCodec, the progressive codec, planar and interleaved bitmap compression, ZGFX and the whole GFX pipeline The virtual channel framework and each channel shipped with it, covering clipboard, drive redirection, printing, smartcard, audio output and input, RAIL, video redirection, serial and parallel ports and USB WinPR, the portability layer, including its SSPI, cryptography, registry, string and synchronisation code, which is reachable from parsing paths above it The client binaries the project ships, xfreerdp , the Wayland client and the SDL client, plus their command-line and configuration handling The server-side implementation and the shadow server, which accept connections from untrusted clients The proxy component, which sits between two RDP parties and parses both directions Out of scope Bugs in Remmina, Apache Guacamole, Proxmox or another downstream product's own code rather than in FreeRDP Microsoft's RDP protocol design, as opposed to a defect in this implementation of it Vendor forks of FreeRDP embedded in appliances rather than the upstream repository A user clicking through a certificate warning the client displayed correctly Reports against an unsupported branch when the same code path is already fixed upstream Upstream library defects in OpenSSL, FFmpeg or similar, unless FreeRDP's own use of them is what makes the bug reachable Most-valued findings Memory corruption in a client-side parser fed by a malicious RDP server. This is the dominant class in the project's record and the reason the advisory count is what it is: the victim is whoever opened the connection, and on a gateway deployment that is a machine holding many users' sessions Codec decoder bugs, particularly RemoteFX, the progressive codec and ZGFX, where compressed input drives length and offset arithmetic before anything validates it Virtual channel handling that reaches beyond the channel, above all drive redirection writing outside the shared path and clipboard handling acting on data the remote side chose Anything in the NLA, CredSSP or NTLM path that accepts an authentication result it should reject, since that is the check standing between a hostile server and a credential Certificate validation failures that let a substituted server pass as the expected one, which turns every client-side parser into a remotely reachable target Defects in the server and proxy implementations reachable pre-authentication, a smaller share of the record and a much higher-value one because the listener is exposed rather than the client Any bug that is reachable through Apache Guacamole's RDP backend, because that path puts a client-side parser behind an internet-facing web gateway Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through one of the two documented channels: the GitHub advisory form on FreeRDP/FreeRDP , where private reporting is enabled, or [email protected] encrypted to the published FreeRDP security team GPG key The triage process is written down and runs to acknowledgement, assignment of a primary contact, affected-version analysis and a CVE request, so expect the version question early and answer it in the first report State which side you attacked. A malicious server hitting a client is the dominant shape here, and a client hitting the server implementation is a separate and rarer case Name the codec, channel or PDU involved and attach the bytes. This codebase is large enough that a crash without a component name is hard to route Findings in Remmina, Guacamole or another consumer that turn out to be FreeRDP's parsing belong here rather than with the downstream product The project offers credit and a CVE. There is no reward and no reward terms to accept Disclosure Coordinated with the FreeRDP security team and published as a GitHub Security Advisory with a CVE alongside a fixed release. The pipeline runs hot and often ships advisories in batches, so plan for an embargo that ends at the next security release rather than at a fixed day count. Downstream consumers rebundle FreeRDP on their own schedules, which stretches real-world exposure well past the upstream fix; hold the detail until the advisory is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability