CVE-2026-85090 in FreeRDP
Summary
by MITRE • 09/03/2026
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical security flaw within the Remote Desktop Protocol client implementation, specifically affecting the handling of Advanced Video Coding (AVC) streams used for high-fidelity remote desktop rendering. This heap-based out-of-bounds read occurs during the chroma plane reconstruction phase when processing RFX_AVC444_BITMAP_STREAM data structures. The root cause lies in the general_ChromaV1ToYUV444 function, which is responsible for converting compressed video data into YUV color space components suitable for display. When a malicious Remote Desktop Protocol server crafts a specially designed bitmap stream with specific frame geometry parameters, it can manipulate internal buffer calculations to exceed the boundaries of the allocated luma plane memory region. This misalignment allows the application to read from adjacent heap memory locations that were not intended to be accessed during this specific decoding operation.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-bounds Read vulnerabilities. The attacker leverages the flexibility of the RDP protocol's video compression standards to construct a payload where the calculated offsets for chroma data retrieval surpass the allocated size of the primary luma buffer. Because FreeRDP operates as a client application that processes untrusted input from remote servers, this vulnerability allows an adversary with network access to trigger arbitrary memory reads on the victim machine. The impact of such a read operation is significant because it can leak sensitive information stored in adjacent heap regions, potentially including cryptographic keys, session tokens, or other private data belonging to the user running the FreeRDP client. In some execution environments, if the out-of-bounds access coincides with executable code or specific memory protection boundaries, it could further facilitate more severe exploitation chains leading to remote code execution.
The operational impact of this vulnerability extends beyond simple information disclosure. By exploiting this heap overflow condition, an attacker can perform reconnaissance on the target system's memory layout, which aids in bypassing modern exploit mitigation techniques such as Address Space Layout Randomization (ASLR). The ability to read arbitrary memory locations provides a reliable mechanism for gathering intelligence about the running process state, including pointers to function tables or global variables. This capability aligns with ATT&CK technique T1057, Process Discovery, and potentially T1003, OS Credential Dumping, depending on what specific data structures are exposed through the memory leak. The vulnerability remains exploitable as long as the client processes AVC444 encoded streams from untrusted or compromised RDP servers, making it a high-risk issue for organizations relying on FreeRDP for remote access solutions without timely patching.
Mitigation strategies primarily involve upgrading to FreeRDP version 3.31.0 or later, where this specific boundary check logic has been corrected to ensure that chroma plane reconstruction respects the allocated memory limits of the luma buffer. Organizations should also implement network segmentation policies to restrict RDP connections to trusted sources only, thereby reducing the attack surface presented by untrusted servers attempting to exploit protocol-level flaws. Additionally, deploying endpoint detection and response solutions capable of monitoring for anomalous heap access patterns can provide an additional layer of defense against exploitation attempts that may occur before patches are applied. Regular vulnerability scanning focused on remote desktop client software versions is essential to maintain a secure posture in environments where FreeRDP is deployed as the primary interface for remote system administration or user workstations.