CVE-2026-109946: FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.11.0 before 3.32.0 are affected when a client connects to an RDP server and negotiates RDPGFX AVC444 or AVC444v2 graphics processing.
What does an attacker need to exploit this?
An attacker needs to operate or compromise an RDP server that a FreeRDP client connects to. During an AVC444-negotiated session, the server can send an in-bounds region rectangle with an odd width to trigger the client assertion.
What is the impact on an affected client?
The assertion aborts the FreeRDP client, terminating the connected RDP session. The provided information describes a denial-of-service impact and does not indicate confidentiality or integrity impact.
How can I determine whether an incident may be related to this issue?
Look for FreeRDP client crashes or aborted sessions occurring after RDPGFX AVC444 or AVC444v2 negotiation, particularly when connecting to an untrusted, malicious, or potentially compromised RDP server.