CVE-2026-109251: FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry

Q: Which clients are exposed to this issue?

FreeRDP clients before 3.32.0 are exposed when they connect to a malicious RDP server using the /video option. The issue is in processing MS-RDPEGT video geometry supplied by the server.

Q: What must an attacker do to trigger the flaw?

An attacker must operate or control an RDP server that the victim connects to and send a negative topLevelLeft geometry value. Exploitation also requires the client to have video support enabled with /video.

Q: What is the impact if exploitation succeeds?

The malicious server can cause an out-of-bounds write involving decoded H.264 picture data, or cause the FreeRDP client to abort. The provided data identifies availability impact but does not identify confidentiality or integrity impact.

Q: What can be done before upgrading?

Avoid connecting affected FreeRDP clients to untrusted RDP servers with /video enabled. Disabling use of the /video option prevents the described trigger condition.

Published Oct 12, 2026

Updated

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.

Affected Software

1 affected component

FreeRDP freerdp<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which clients are exposed to this issue?

FreeRDP clients before 3.32.0 are exposed when they connect to a malicious RDP server using the /video option. The issue is in processing MS-RDPEGT video geometry supplied by the server.

What must an attacker do to trigger the flaw?

An attacker must operate or control an RDP server that the victim connects to and send a negative topLevelLeft geometry value. Exploitation also requires the client to have video support enabled with /video.

What is the impact if exploitation succeeds?

The malicious server can cause an out-of-bounds write involving decoded H.264 picture data, or cause the FreeRDP client to abort. The provided data identifies availability impact but does not identify confidentiality or integrity impact.

What can be done before upgrading?

Avoid connecting affected FreeRDP clients to untrusted RDP servers with /video enabled. Disabling use of the /video option prevents the described trigger condition.

CVE-2026-109251: FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry

Affected Software

Event History

Frequently Asked Questions

Which clients are exposed to this issue?

What must an attacker do to trigger the flaw?

What is the impact if exploitation succeeds?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this issue?

What must an attacker do to trigger the flaw?

What is the impact if exploitation succeeds?

What can be done before upgrading?