FreeRDP CVE-2026-109251

Exploitation requires the FreeRDP client to connect using the non-default /video option (MS-RDPEGT video/geometry redirection) to an attacker-controlled or compromised RDP server, and the user must initiate that connection (UI:P). The specific trigger is a server-supplied signed MS-RDPEGT geometry origin with a negative topLevelLeft value, which is stored unchecked in an unsigned video surface coordinate. Limiting factors that reduce realistic risk: this is a server-attacks-client (reverse) scenario rather than a directly reachable service, /video redirection must be explicitly enabled (not default), the victim must choose to connect to the malicious server, and only FreeRDP versions before 3.32.0 are affected.

This is a medium-severity (CVSS 4.0 base 6.0) client-side flaw in a malicious-server attack model, and the real-world risk is meaningfully lower than the network attack vector alone suggests. While AV:N and PR:N indicate a remote, unauthenticated vector, both AT:P (a specific attack requirement) and UI:P (passive user interaction) materially constrain it: the victim must actively initiate an RDP connection using the non-default /video option to an attacker-controlled or compromised server. There is no CISA KEV listing and no public exploit was identified, so exploitation is not confirmed in the wild; EPSS was not provided in the input but the client-side, victim-must-connect model typically yields low exploitation probability. The documented impact is primarily availability (VA:H - client crash/abort). Note a conflict worth verifying: the description states an out-of-bounds WRITE of decoded H.264 data, which normally implies an integrity/memory-corruption impact, yet the supplied CVSS 4.0 vector rates VI:N (no integrity impact) - this likely understates the ceiling (potential memory corruption leading to code execution) and should be verified with the FreeRDP advisory. Overall this is a legitimate but non-urgent patch-cycle item, better suited to targeted attacks (luring a victim to a rogue server) than widespread automated exploitation.

An attacker runs or compromises an RDP server and lures a victim into connecting to it with FreeRDP's non-default /video option enabled. The server sends a malicious MS-RDPEGT geometry message carrying a negative topLevelLeft origin; stored unchecked in an unsigned surface coordinate, it wraps in 32-bit arithmetic and bypasses the blit clamp in gdiVideoShowSurface(), producing an out-of-bounds write of decoded H.264 data or a client abort. No public exploit was identified at time of analysis, and success requires the victim to initiate the connection (UI:P) with video redirection active.