CVE-2026-109938: FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update
Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients from version 3.11.0 before 3.32.0 are affected when video redirection is enabled. The triggering server may be malicious or compromised.
What must an attacker do to trigger the vulnerability?
The user must connect to the attacker-controlled RDP server, making user interaction necessary. The server can then send positive mapped-video geometry coordinates that trigger the integer overflow.
What is the practical impact on an affected client?
The issue can abort and terminate the FreeRDP client. The provided impact information indicates an availability impact, with no stated confidentiality or integrity impact.
Does this affect FreeRDP's default configuration?
The available information only identifies clients with video redirection enabled as affected. It does not state whether video redirection is enabled by default.