Advisory · CVE-2026-111382
Malicious RDP server can write past the heap in FreeRDP client video decoding
FreeRDP clients before 3.32.0 write one row past the destination planes when combining AVC444 video frames with an odd height, giving a malicious server a heap out-of-bounds write. CVSS 3.1 8.8.
- Vendor
- FreeRDP
- Product
- FreeRDP
- Identifier / CWE
- CVE-2026-111382
CWE-787 - Action timing
- Immediate
Explain it like I’m five
When a video frame has an odd number of rows, the client paints one row too many and spills into memory it does not own, and the server chooses the frames.
- 01Client connects
A user connects an affected FreeRDP client to a malicious or compromised RDP server.
- 02Crafted graphics sent
The server sends RDPGFX AVC444 frames for a region with an odd height whose bottom equals the surface height.
- 03Combine loop overruns
The YUV444 combine functions use a rounded-up half height with no row guard, so the last iteration targets a row past the destination planes.
- 04Heap overwritten
One full row is written past the tightly allocated U and V planes in all backends, corrupting client heap memory.
What happened
The GitHub advisory for FreeRDP describes two client-side heap out-of-bounds writes in the AVC444 and AVC444v2 YUV444 combine path, reachable from a malicious or compromised RDP server through the RDPGFX graphics channel. Affected releases are before 3.32.0.
In general_LumaToYUV444 and general_ChromaV2ToYUV444, the loops use a rounded-up half height and write destination rows without checking that the row stays within the surface height. For a region with an odd height whose bottom equals the surface height, the last iteration writes one full row past the tightly allocated destination U and V planes. The general, SSE4.1, and NEON backends are all affected.
The advisory notes these writes are related to, but not covered by, the 3.31.0 fix for an out-of-bounds read in a neighbouring function, so a client patched only to 3.31.0 is still exposed to this issue.
What to do
- Inventory FreeRDP clients on all platforms, including builds bundled inside other remote access tools.
- Upgrade affected clients to FreeRDP 3.32.0 or later using the project release guidance.
- Until clients are patched, avoid connecting to untrusted RDP servers; treat unfamiliar RDP endpoints as hostile code execution surface.
- Review client crash reports for faults in the graphics or H.264 decode path after sessions with unfamiliar servers.
- Verify the deployed client version after the upgrade.
Management note
Remote desktop clients invert the usual trust model: the server drives the client’s parsers. Any staff who connect to third-party or customer RDP servers with unpatched FreeRDP builds are carrying the risk, so client patching matters as much as server patching here.