FreeRDP CVE-2026-44421

Exploitation requires the victim to initiate an RDP session to an attacker-controlled or attacker-compromised RDP server (UI:R user interaction) using a FreeRDP-based client older than 3.26.0 with the RDPGFX (MS-RDPEGFX Graphics Pipeline) channel negotiated and enabled - the upstream default in modern builds, commonly invoked via the /gfx flag or auto-enabled by GUI wrappers like Remmina. No client-side authentication or elevated privileges are needed on the victim host (PR:N), and the attack vector is network (AV:N), but the server-to-client direction means the attacker cannot reach the bug by scanning Internet-exposed RDP listeners; they must induce an outbound connection. Deployments that disable the Graphics Pipeline Extension or restrict outbound RDP to trusted servers are not reachable.

The CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, unauthenticated, low-complexity flaw with full CIA impact but requiring user interaction - consistent with a malicious-server attack where the user must initiate or accept an RDP connection. Real-world risk is moderated because exploitation is server-to-client (reverse direction from typical RDP attacks), so the attacker must lure a victim into connecting to a hostile server, and the client must have RDPGFX enabled (default in modern FreeRDP builds). EPSS, KEV status, and SSVC decision points are not provided in the supplied intelligence, so probability of in-the-wild exploitation cannot be quantified; the GHSA advisory is the sole reference and no POC is linked. Heap-overflow-to-RCE on a hardened Linux heap (glibc with ASLR/NX) typically requires a tailored exploit, so crash-level impact is highly likely while reliable code execution is plausible but not demonstrated in available data.

An attacker stands up a malicious RDP server and lures a target into connecting - for example, via a phishing email containing an .rdp attachment, a malicious rdp:// URI handler invocation, or a compromised jump-host listing. Once the victim's FreeRDP client negotiates the RDPGFX channel, the server sends a crafted CacheToSurface PDU with oversized cacheEntry width/height, triggering the heap overflow in the client process and resulting in a client crash or, with a tailored payload, code execution in the user's session. No public exploit is identified at time of analysis, so weaponization currently requires the attacker to develop their own heap-grooming chain.