GHSA-p6r2-4hgm-m6ff: FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

Q: Who is exposed to exploitation?

FreeRDP clients before version 3.26.0 are exposed when they connect to a malicious RDP server. The issue is remotely reachable, requires no attacker privileges, and requires user interaction in the form of connecting to the server.

Q: What does an attacker need to do to trigger the flaw?

An attacker needs to operate or control an RDP server and send crafted cache-to-surface rectangle data. The malformed dimensions can bypass rectangle validation and cause FreeRDP to copy data beyond a heap buffer.

Q: What is the impact if exploitation succeeds?

A malicious server can cause an out-of-bounds heap write in the client, which may crash the FreeRDP client or potentially allow remote code execution. Integrity, confidentiality, and availability of the affected client are all rated as high impact.

Q: How can I determine whether I am affected?

Check the FreeRDP version in use. Versions earlier than 3.26.0 are affected; version 3.26.0 or later is not identified as affected by the provided information.

Published May 26, 2026

Updated

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdiCacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

Affected Software

1 affected component

FreeRDP freerdp<3.26.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.26.0

Event History

May 26, 2026

CVE Published

via OSV·02:08 PM

Data Sourced

via OSV·02:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

FreeRDP clients before version 3.26.0 are exposed when they connect to a malicious RDP server. The issue is remotely reachable, requires no attacker privileges, and requires user interaction in the form of connecting to the server.

What does an attacker need to do to trigger the flaw?

An attacker needs to operate or control an RDP server and send crafted cache-to-surface rectangle data. The malformed dimensions can bypass rectangle validation and cause FreeRDP to copy data beyond a heap buffer.

What is the impact if exploitation succeeds?

A malicious server can cause an out-of-bounds heap write in the client, which may crash the FreeRDP client or potentially allow remote code execution. Integrity, confidentiality, and availability of the affected client are all rated as high impact.

How can I determine whether I am affected?

Check the FreeRDP version in use. Versions earlier than 3.26.0 are affected; version 3.26.0 or later is not identified as affected by the provided information.

GHSA-p6r2-4hgm-m6ff: FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to trigger the flaw?

What is the impact if exploitation succeeds?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to trigger the flaw?

What is the impact if exploitation succeeds?

How can I determine whether I am affected?