Freerdp CVE-2026-29774

|

EUVD

EUVD-2026-12055 MEDIUM

Out-of-bounds Write (CWE-787)

2026-03-13 GitHub_M

Buffer Overflow Memory Corruption Freerdp Red Hat Suse

5.3

CVSS 3.1 · GitHub Advisory

Share

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

4

Patch available

Apr 16, 2026 - 05:29 EUVD

3.24.0

EUVD ID Assigned

Mar 13, 2026 - 18:00 euvd

EUVD-2026-12055

Analysis Generated

Mar 13, 2026 - 18:00 vuln.today

CVE Published

Mar 13, 2026 - 17:26 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.

AnalysisAI

A client-side heap buffer overflow vulnerability exists in FreeRDP's AVC420/AVC444 YUV-to-RGB color space conversion code due to missing horizontal bounds validation of H.264 metablock region coordinates. FreeRDP versions prior to 3.24.0 are affected, allowing a malicious RDP server to trigger out-of-bounds memory writes via specially crafted WIRE_TO_SURFACE_PDU_1 packets with oversized regionRects left coordinates, resulting in denial of service through heap corruption. The vulnerability requires no user interaction or authentication and has a CVSS score of 5.3 with EPSS risk classification indicating moderate exploitation likelihood; no public exploit code is known to exist at this time.

Technical ContextAI

FreeRDP (cpe:2.3:a:freerdp:freerdp) is a free software implementation of the Remote Desktop Protocol (RDP) used by both clients and servers for remote desktop functionality. The vulnerability resides in the yuv.c color conversion module, specifically in the avc420_yuv_to_rgb function (line 67) which converts AVC420 H.264-encoded video frames from YUV color space to RGB for display. The root cause is classified as CWE-787 (Out-of-bounds Write) and stems from the clamp() function (line 347) only validating top/bottom coordinates against surface height while completely omitting horizontal validation against surface width. When the H.264 decoder processes a WIRE_TO_SURFACE_PDU_1 frame containing a regionRects entry with a left coordinate vastly exceeding the allocated surface buffer width (e.g., left=60000 on a 128-pixel-wide surface), the destination pointer calculation (pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4) performs unchecked arithmetic that can reach 1888+ bytes beyond the heap allocation. Subsequent SSE (Streaming SIMD Extensions) vector write operations then corrupt arbitrary heap memory locations.

RemediationAI

Upgrade FreeRDP to version 3.24.0 or later, which includes the fix for missing horizontal bounds validation in the yuv.c clamp() function. Obtain the patched version from the official FreeRDP GitHub repository (https://github.com/FreeRDP/FreeRDP/releases) or from your Linux distribution's package manager. Until patching is possible, limit RDP client connections to trusted and verified servers only, disable RDP access from untrusted networks via firewall rules, and consider using VPN-based access controls to enforce network segmentation. Organizations unable to immediately upgrade should review their RDP endpoint access policies and restrict connections to internal RDP gateways rather than direct internet-exposed servers. Monitor heap corruption-related crashes in FreeRDP logs as a potential indicator of exploitation attempts.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2017-11882 HIGH POC

CVE-2010-3333 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed

Share

CVE-2026-29774 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy