FreeRDP EUVD-2026-102563

Exploitation requires the victim's FreeRDP client (any build before 3.32.0) to establish an RDP session to an attacker-controlled or compromised server AND to negotiate the RDPGFX graphics pipeline with AVC444 or AVC444v2 (H.264 YUV444) codec support. The specific trigger is a server-sent region rect with odd height whose extent ends exactly at the surface height, causing the OOB write past the U/V planes. Limiting factors: this is a client-side flaw, so the attacker cannot reach a passive/idle client - a user must initiate or accept an outbound connection to the malicious server (UI:P), meaning drive-by or server-side reachability does not apply; environments where clients only connect to trusted, internal RDP hosts face substantially lower realistic risk.

This is a credible high-priority client-side vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 8.7) indicates a network-reachable, low-complexity flaw with no attacker privileges but requiring passive user interaction (UI:P), yielding full confidentiality, integrity, and availability impact on the vulnerable client with no scope change. The signals are internally consistent: a heap out-of-bounds write (CWE-787) in FreeRDP's AVC444/AVC444v2 YUV444 decode path is triggered when a victim CLIENT connects to an attacker-controlled RDP server - so 'network, unauthenticated' here means the malicious server needs no credentials, while UI:P reflects that a user must initiate or accept the connection. No EPSS score was provided, there is no CISA KEV listing in the input, and no proof-of-concept is referenced, so real-world exploitation pressure is currently unquantified rather than confirmed. The practical risk is driven by memory-corruption-to-RCE potential against a very widely embedded RDP client library, tempered by the requirement that the victim connect to a hostile or compromised server. Net: a genuine priority for environments where users connect out to untrusted RDP endpoints, but not evidence of mass active exploitation given the missing EPSS/KEV/POC signals.

A victim uses a FreeRDP-based client (before 3.32.0) to connect to an RDP server controlled or compromised by an attacker. The malicious server sends crafted RDPGFX AVC444 or AVC444v2 frames containing region rects with odd height ending at the surface height, triggering a heap out-of-bounds write past the U/V planes in general_LumaToYUV444/general_ChromaV2ToYUV444, corrupting client heap memory and potentially achieving code execution on the client. No public exploit is identified at time of analysis.