CVE-2025-68118

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function `freerdp_certificate_data_hash_ uses` the Microsoft-specific `_snprintf` function to format certificate cache filenames without guaranteeing NUL termination when truncation occurs. According to Microsoft documentation, `_snprintf` does not append a terminating NUL byte if the formatted output exceeds the destination buffer size. If an attacker controls the hostname value (for example via server redirection or a crafted .rdp file), the resulting filename buffer may not be NUL-terminated. Subsequent string operations performed on this buffer may read beyond the allocated memory region, resulting in a heap-based out-of-bounds read. In default configurations, the connection is typically terminated before sensitive data can be meaningfully exposed, but unintended memory read or a client crash may still occur under certain conditions. Version 3.20.0 has a patch for the issue.

• CWE-125

• https://github.com/FreeRDP/FreeRDP/commit/a0b21f992a9de1de2468fc9e600aa2b7a4066307Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h78c-5cjx-jw6xVendor Advisory

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68111ChurchCRM is an open-source church management system. In ver…7.2
• CVE-2025-68112ChurchCRM is an open-source church management system. In ver…8.8
• CVE-2025-68113ALTCHA is privacy-first software for captcha and bot protect…6.5
• CVE-2025-68114Capstone is a disassembly framework. In versions 6.0.0-Alpha…9.8
• CVE-2025-68115Parse Server is an open source backend that can be deployed …6.1
• CVE-2025-68116FileRise is a self-hosted web file manager / WebDAV server. …5.4
• CVE-2025-68119Downloading and building modules with malicious version stri…7
• CVE-2025-68120To prevent unexpected untrusted code execution, the Visual S…5.4
• CVE-2025-68121During session resumption in crypto/tls, if the underlying C…10
• CVE-2025-68124Rejected reason: reserved but not needed
• CVE-2025-68125Rejected reason: reserved but not needed
• CVE-2025-68126Rejected reason: reserved but not needed