CVE-2026-111382: FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running a version before 3.32.0 are exposed when they connect to a malicious RDP server that delivers RDPGFX AVC444 or AVC444v2 content.
What does an attacker need to exploit it?
The attacker needs to operate or control an RDP server that the vulnerable client connects to. Exploitation requires user interaction because the client must initiate or accept that RDP connection.
What condition triggers the out-of-bounds write?
The malicious server must send AVC444 or AVC444v2 frames containing odd-height region rectangles that end at the surface height. This can cause writes past the U and V planes during YUV444 conversion.
How can the issue be remediated?
Upgrade FreeRDP to version 3.32.0 or later. The provided data does not identify an alternative mitigation for systems that cannot yet be upgraded.