CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111382 FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111382

FreeRDP before version 3.32.0 is vulnerable to a client-side heap out-of-bounds write in the general_LumaToYUV444 and general_ChromaV2ToYUV444 functions. A malicious RDP server can trigger this by sending RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at the surface height, ...

Linux Distros Unpatched Vulnerability : CVE-2026-109946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion an...

DEBIAN-CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by...

CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by...

CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by...

CVE-2026-109946

The FreeRDP client versions 3.11.0 before 3.32.0 are vulnerable to a reachable assertion (CWE-617) during YUV444 conversion. The software fails to validate that AVC444 and AVC444v2 region widths are even numbers. A malicious or compromised RDP server can trigger a client crash by sending an in-bo...

CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by...

Amazon Linux 2 : freerdp (ALAS-2026-3938)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3938 advisory. A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive...

SUSE CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can send specially crafted AVC444 graphics updates. This can cause the pooldecoderect function to enter an infinite loop when decoding AVC444 metablocks with an excessive number of region rectangles. The vulnerability lea...

DEBIAN-CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952 FreeRDP before 3.31.0 Denial of Service via pool_decode_rect

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

FreeRDP versions before 3.31.0 are vulnerable to an infinite-loop denial of service in the pool_decode_rect function. When a malicious RDP server sends crafted AVC444 graphics updates with more region rectangles than the preallocated worker array size, the threaded decode path loops indefinitely,...

EUVD-2026-78809

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952 FreeRDP before 3.31.0 Denial of Service via pool_decode_rect

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

PT-2026-92071

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description An infinite-loop denial of service occurs during the decoding of AVC444 metablocks when the number of region rectangles exceeds the preallocated worker array size. A malicious RDP server can trigger...