OESA-2021-1424
Record from OSV · Published November 9, 2021
FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp. Security Fix(es): FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.(CVE-2021-41160)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| freerdp | openEuler:20.03-LTS-SP2 | 2.4.1-1.oe1 |
| freerdp | openEuler:20.03-LTS-SP1 | 2.4.1-1.oe1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| openEuler:20.03-LTS-SP2 | freerdp | 0 |
| openEuler:20.03-LTS-SP1 | freerdp | 0 |
Timeline
- Nov 9, 2021 CVE Published
- Aug 18, 2026 CVE Updated
- Nov 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln OESA-2021-1424
vulnetix vdb fixes OESA-2021-1424Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/OESA-2021-1424/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart