CVE-2026-109251

FreeRDP versions prior to 3.32.0 are vulnerable to an Out-of-Bounds Write due to improper validation of server-supplied MS-RDPEGT geometry origin. The issue occurs because the software stores this origin in an unsigned video surface coordinate, causing the blit clamp in gdiVideoShowSurface() to w...

EUVD-2026-97695

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting wi...