CVE-2026-111382
8.8HighPublished 16 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
A malicious RDP server can corrupt client memory and potentially achieve remote code execution when a user connects to it. An attacker requires the user to initiate an RDP connection to an untrusted server.
Root cause
A heap out-of-bounds write occurs in general_LumaToYUV444 and general_ChromaV2ToYUV444 when handling RDPGFX AVC444/AVC444v2 frames with odd-height region rects that end at surface height.
Affected systems
FreeRDP versions before 3.32.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade FreeRDP to version 3.32.0 or later. As an interim workaround, avoid connecting to untrusted RDP servers.
$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.