CVE-2026-121950: FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap

Q: Who is exposed to this issue?

FreeRDP clients that connect to an untrusted or malicious RDP server are exposed. The affected software entries are debian/freerdp3 and debian/freerdp2; the issue affects FreeRDP versions before 3.32.2.

Q: What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a victim connects to and send an RDPGFX CREATE_SURFACE PDU. No attacker privileges are required, but user interaction is required because the client must initiate the RDP connection.

Q: What is the impact on 32-bit versus 64-bit clients?

On 32-bit builds, the surface-dimension multiplication can wrap and lead to heap memory corruption. On 64-bit builds, the same dimensions can request an approximately 4 GiB allocation, causing denial of service.

Q: How can I identify attempted exploitation?

Inspect RDPGFX CREATE_SURFACE traffic or server behavior for a surface width and height of 32766. A client crash, heap-corruption symptoms on 32-bit builds, or an attempted approximately 4 GiB allocation on 64-bit builds during an RDP session are relevant indicators.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATESURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients that connect to an untrusted or malicious RDP server are exposed. The affected software entries are debian/freerdp3 and debian/freerdp2; the issue affects FreeRDP versions before 3.32.2.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a victim connects to and send an RDPGFX CREATE_SURFACE PDU. No attacker privileges are required, but user interaction is required because the client must initiate the RDP connection.

What is the impact on 32-bit versus 64-bit clients?

On 32-bit builds, the surface-dimension multiplication can wrap and lead to heap memory corruption. On 64-bit builds, the same dimensions can request an approximately 4 GiB allocation, causing denial of service.

How can I identify attempted exploitation?

Inspect RDPGFX CREATE_SURFACE traffic or server behavior for a surface width and height of 32766. A client crash, heap-corruption symptoms on 32-bit builds, or an attempted approximately 4 GiB allocation on 64-bit builds during an RDP session are relevant indicators.

CVE-2026-121950: FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact on 32-bit versus 64-bit clients?

How can I identify attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact on 32-bit versus 64-bit clients?

How can I identify attempted exploitation?