UBUNTU-CVE-2026-121950: Buffer Overflow

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATESURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.

Affected Software

2 affected components

ubuntu/freerdp*

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

FreeRDP clients running a version before 3.32.2 are exposed when they connect to an attacker-controlled or malicious RDP server. The vulnerable behavior differs by architecture: 32-bit builds can suffer heap corruption, while 64-bit builds may attempt an allocation of approximately 4 GiB.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a FreeRDP client connects to. Exploitation requires user interaction because the client must initiate the connection; no client-side privileges are required.

What happens if exploitation succeeds?

A malicious server can send an RDPGFX CREATE_SURFACE message with width and height set to 32766. This can cause a heap buffer overflow on 32-bit builds or trigger a denial of service through a very large allocation on 64-bit builds.

UBUNTU-CVE-2026-121950: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What happens if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What happens if exploitation succeeds?