FreeRDP EUVD-2026-102556

Exploitation requires the victim to connect with the Windows FreeRDP client (wfreerdp, versions 3.0.0 through 3.31.x) to an attacker-controlled or compromised RDP server, and RemoteApp/RAIL (Remote Application Integrated Locally) must be in use so that WINDOW_ORDER_FIELD_TITLE window-title updates are processed by wf_rail_window_common. The attacker must control the server side of the connection; there is no path for an unauthenticated internet attacker to push this to a passive client. Limiting factors: this is a reverse (server-to-client) attack dependent on luring the user to a malicious server, exploitation complexity is high (AC:H/AT:P), and impact is confined to window-title corruption, adjacent heap memory disclosure, and client crash - no code execution or integrity impact.

This is a server-to-client (reverse) vulnerability: a malicious or compromised RDP server attacks the FreeRDP client, so it is not a mass-exploitable network-facing flaw despite AV:N. The provided CVSS 4.0 score is 6.3 (medium); the vector pairs AV:N with AC:H and AT:P, correctly reflecting that exploitation is non-trivial and requires the victim to connect to an attacker-controlled server. Impact is intentionally bounded - VC:L/VI:N/VA:L maps to adjacent heap memory disclosure (title corruption) and client crash via CWE-125, with no integrity impact and no code execution claimed. No EPSS score is provided in the input, this CVE is not listed in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent rather than conflicting: a medium CVSS, no KEV, and no POC together indicate a genuine but low-urgency, client-side issue that matters most to environments where users connect to untrusted RDP/RemoteApp servers. Patch prioritization is warranted for RAIL/RemoteApp users but this is not an emergency widespread-exploitation scenario.

An attacker stands up a malicious RDP server (or compromises a legitimate RemoteApp server) and lures a user to connect with the Windows FreeRDP client. The server sends a full-length, non-NUL-terminated WINDOW_ORDER_FIELD_TITLE window-title update, which wf_rail_window_common passes to SetWindowTextW, causing a heap over-read that corrupts window titles or crashes the client and may expose adjacent heap memory. No public exploit code is identified at time of analysis, and exploitation complexity is high (AC:H/AT:P).