{"id":"CVE-2026-121950","kind":"vulnerability","aliases":["CVE-2026-121950"],"related":[],"title":"FreeRDP: unchecked surface size lets a malicious server corrupt client memory","description":"FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.","summary":"FreeRDP clients fail to validate the product of surface width and height when handling an RDPGFX CREATE_SURFACE message. A malicious RDP server can send a crafted message that causes a heap overflow on 32-bit builds or a roughly 4 GiB allocation on 64-bit builds, leading to memory corruption or denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","package","rdp","remote-desktop"],"not_affected_if":["no-rdp-client","rdpgfx-disabled"],"how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or the package manager, and compare it to the fixed range below.\n- Find which applications bundle FreeRDP (remote desktop clients, embedded RDP libraries) and check their versions.\n- Confirm whether the client is a 32-bit build, since that is where the overflow is worst.","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:47+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","triaged_at":"2026-11-04T16:28:56+00:00","updated_at":"2026-11-04T16:28:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T16:28:56Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: unchecked surface size lets a malicious server corrupt client memory","impact":"high","summary":"FreeRDP clients fail to validate the product of surface width and height when handling an RDPGFX CREATE_SURFACE message. A malicious RDP server can send a crafted message that causes a heap overflow on 32-bit builds or a roughly 4 GiB allocation on 64-bit builds, leading to memory corruption or denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"heap memory corrupted or client crashes via malicious server","analyst_note":"Check the vendor advisory on github.com and the VulnCheck advisory to confirm the RDPGFX default-on status and any additional affected ranges.","how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or the package manager, and compare it to the fixed range below.\n- Find which applications bundle FreeRDP (remote desktop clients, embedded RDP libraries) and check their versions.\n- Confirm whether the client is a 32-bit build, since that is where the overflow is worst.","plain_action":"","needs_analyst":true,"not_affected_if":["no-rdp-client","rdpgfx-disabled"],"who_is_affected":"Only FreeRDP clients connecting to RDP servers can be exposed, and the risk comes from the server being malicious or impersonated. Teams that only run FreeRDP servers or use other RDP clients can skip it. Applications that embed FreeRDP as a library are affected through that library version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4239,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121950':14A,17A '-2026':13A,16A '3.32.2':81C '32':58B,109C '32766':136C '4':64B,115C '64':68B,119C 'alloc':66B,117C 'approxim':114C 'bit':59B,69B,110C,120C 'buffer':106C 'build':60B,70B,111C,121C 'caus':53B,100C,146C 'check':84C 'client':10A,25B,140C 'connect':139C 'corrupt':9A,74B,142C 'craft':50B 'creat':40B,97C,129C 'createsurfac':92C 'cve':12A,15A 'denial':76B,148C 'desktop':23B 'dimens':89C 'fail':26B 'freerdp':1A,18B,24B,79C 'gdi':91C 'gib':65B,116C 'handl':37B,94C 'heap':55B,105C,143C 'height':35B,135C 'integ':102C 'lead':71B 'let':5A 'malici':7A,44B,123C 'memori':11A,73B,144C 'messag':42B,51B 'overflow':56B,107C 'packag':19B 'pdu':99C,131C 'product':30B,86C 'rdp':20B,45B,124C 'rdpgfx':39B,96C 'remot':22B 'remote-desktop':21B 'rough':63B 'send':48B,127C 'server':8A,46B,125C 'servic':78B,150C 'size':4A 'surfac':3A,32B,41B,88C,98C,130C 'uncheck':2A 'valid':28B 'width':33B,133C 'wrap':103C","nicknames":[],"mitigations":[],"who_affected":"Only FreeRDP clients connecting to RDP servers can be exposed, and the risk comes from the server being malicious or impersonated. Teams that only run FreeRDP servers or use other RDP clients can skip it. Applications that embed FreeRDP as a library are affected through that library version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","package","rdp","remotedesktop"],"campaign_type":null,"first_public_at":"2026-10-20T17:09:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121950","severity":null,"published_at":"2026-11-04T16:17:47+00:00","modified_at":"2026-11-04T16:17:47+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","fetched_at":"2026-11-04T16:28:11+00:00","note":null}],"documents":[{"id":68470,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f53w-3364-jr35","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:09:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68471,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-overflow-via-rdpgfx-create-surface-integer-wrap","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}