4 matches found
CVE-2026-121950
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a...
CVE-2026-121950
FreeRDP versions prior to 3.32.2 are vulnerable to a heap buffer overflow due to an integer wrap in the gdi_CreateSurface function. The issue occurs when handling an RDPGFX CREATE_SURFACE PDU because the software fails to validate the product of surface dimensions. On 32-bit builds , this allows ...
EUVD-2026-116950
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a...
CVE-2026-121950 FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a...