CVE-2026-109251GHSA-grvc-qhhp-7h6m
FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry
FreeRDP FreeRDP
CVSS
6.0MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.
Text from CVE List
Affected versions 2
- FreeRDPaffected: all versions before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List