Live › vulnerability › CVE-2026-111382
Go to dashboardFreeRDP clients up to 3.31.1 write one row past the heap U/V planes in general_LumaToYUV444 and general_ChromaV2ToYUV444. This happens when a malicious RDP server sends an RDPGFX AVC444 or AVC444v2 frame whose region rect has an odd height and ends at the surface height. It corrupts client heap memory and can lead to code execution as the connecting user. The user has to connect to the hostile or compromised server. Fixed in 3.32.0.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| freerdp | vendor | < 3.32.0 | 3.32.0 |
| freerdp | vendor | <= 3.31.1 (< 3.32.0) | 3.32.0 |
3.32.0 is affected, and so are apps that bundle libfreerdpfreerdp* or libfreerdp*rpm -q freerdp3.32.0 or later2.11.7) still listed vulnerableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-111382")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.