CVE-2026-109251 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical integer overflow and type confusion issue within the Remote Desktop Protocol (RDP) video rendering subsystem, specifically affecting the MS-RDPEGT geometry handling logic. This flaw stems from an improper validation of server-supplied data where signed geometric coordinates are stored directly into unsigned variables representing video surface positions. In standard RDP operations involving hardware-accelerated or software-rendered H.264 decoding, the client must calculate screen offsets to correctly position decoded frames on the display buffer. The function gdiVideoShowSurface() is responsible for managing this blitting process, which includes clamping coordinates to ensure they remain within valid memory boundaries of the allocated video surface. However, because the geometry origin was stored in an unsigned type without proper range checking against signed input values from the server, negative coordinate values such as a negative topLevelLeft parameter are interpreted as large positive integers due to two's complement representation rules.
This misinterpretation leads directly to arithmetic wraparound during 32-bit calculations used for boundary checks and memory offset computations. When a malicious RDP server sends a crafted packet containing a negative topLevelLeft value, the client interprets this as an extremely high unsigned coordinate. Consequently, the blit clamp logic in gdiVideoShowSurface() fails to trigger because it compares against positive bounds that are vastly exceeded by the wrapped-around large integer. This effectively disables the safety mechanisms designed to prevent out-of-bounds memory access. The operational impact is severe, allowing a remote attacker controlling a malicious RDP server to force the client application to write decoded H.264 picture data outside the allocated buffer boundaries. Such an out-of-bounds write can lead to arbitrary code execution if the adjacent memory contains executable instructions or critical control structures that can be overwritten with controlled payloads. Alternatively, depending on the specific memory layout and allocation patterns of the FreeRDP process at the time of exploitation, this corruption may result in a denial of service through application crash or abort rather than full remote code execution.
From a classification perspective, this vulnerability aligns closely with CWE-190 Integer Overflow or Wraparound, as the core failure involves incorrect handling of signed-to-unsigned conversion leading to arithmetic errors that bypass security checks. It also relates to CWE-787 Out-of-bounds Write, since the ultimate consequence is writing data beyond the intended memory buffer limits due to failed boundary validation. In terms of adversary tactics and techniques, this exploit scenario maps to ATT&CK technique T1203 Exploitation for Client Execution, where an attacker leverages a vulnerability in client-side software accessed via network protocols like RDP to execute malicious code on the target system without user interaction beyond establishing the connection. The attack vector is remote over the network, requiring only that the victim connects to a compromised or adversarial-controlled RDP server with video acceleration enabled using the /video flag.
Mitigation strategies for this vulnerability primarily involve upgrading FreeRDP to version 3.32.0 or later, where the developers have implemented proper type casting and range validation for geometry origins before they are used in surface coordinate calculations. Administrators should ensure that all client endpoints running FreeRDP are patched promptly to prevent exploitation by malicious RDP servers. In environments where immediate patching is not feasible, network-level controls such as firewalls or intrusion prevention systems can be configured to inspect and block suspicious RDP traffic patterns associated with this exploit vector, although deep packet inspection for complex protocol logic like MS-RDPEGT geometry parsing may have limitations. Additionally, disabling video acceleration features by omitting the /video flag in client connections reduces the attack surface related to this specific code path, though it may impact performance and user experience. Organizations should also enforce strict policies regarding which RDP servers clients are permitted to connect to, minimizing exposure to untrusted or potentially malicious remote desktop services that could attempt to exploit these protocol-level parsing flaws.