CVE-2026-111382 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical client-side memory safety issue rooted in improper bounds checking within the video decoding subsystem. Specifically, the flaw resides in two functions responsible for color space conversion: general_LumaToYUV444 and general_ChromaV2ToYUV444. These routines are invoked when processing RDP Graphics Pipeline (RDPGFX) frames that utilize the AVC444 or AVC444v2 compression formats. The core technical deficiency is a failure to validate the dimensions of region rectangles against the allocated memory buffers for chroma planes, particularly under specific geometric conditions involving odd-height regions aligned with surface boundaries.
When an attacker controls the RDP server and sends specially crafted frames containing region rectangles with odd heights that end exactly at the surface height, the decoding logic miscalculates the write offsets for the U and V color channels. This miscalculation results in a heap out-of-bounds write operation where data is written past the allocated memory space of the chroma planes. Because this occurs within the client application's process memory, it leads to direct corruption of adjacent heap structures or arbitrary memory locations depending on the layout of the allocator. Such heap corruption destabilizes the application state and creates a primitive that can be leveraged for more severe exploitation scenarios.
The operational impact of this vulnerability is significant as it allows malicious RDP servers to compromise the integrity of the client machine upon connection. By exploiting the heap out-of-bounds write, an attacker can potentially achieve arbitrary code execution on the victim's system. This transforms a standard remote desktop protocol interaction into a vector for initial access and subsequent privilege escalation or lateral movement within a network environment. The vulnerability affects any user connecting to a compromised or malicious RDP server using an unpatched version of FreeRDP, making it a high-risk issue in enterprise environments where remote desktop connections are frequent.
From a classification perspective, this flaw aligns with CWE-787: Out-of-bounds Write, which describes writing data outside the bounds of a buffer. In terms of adversary tactics and techniques, this vulnerability facilitates exploitation consistent with ATT&CK technique T1203: Exploitation for Client Execution, where attackers exploit software vulnerabilities to execute code on client systems. The specific mechanism involves manipulating input validation logic during media processing, which is a common pattern in remote protocol implementations that handle complex binary data structures like video frames.
Mitigation strategies must prioritize immediate patching of the FreeRDP installation to version 3.32.0 or later, where these bounds checking issues have been addressed by developers. In environments where immediate patching is not feasible due to operational constraints, network-level controls should be implemented to restrict RDP connections only to trusted and verified servers. Additionally, deploying endpoint detection and response solutions that monitor for anomalous memory access patterns in video decoding processes can provide an additional layer of defense against exploitation attempts. Organizations should also review their incident response plans to include procedures for detecting potential heap corruption indicators, such as application crashes or unusual memory usage spikes during RDP sessions.