FreeRDP EUVD-2026-115943

The victim must run an X11 FreeRDP client with the RDPGFX channel active and connect to an attacker-controlled or compromised RDP server; the server must first create a surface and then map it to oversized scaled output via MAPSURFACETOSCALEDOUTPUT. Two concrete trigger paths are documented: (1) the default software-GDI path additionally requires a later X Expose event reaching xf_OutputExpose's checked UINT16 cast, which in the preserved evidence only aborts in verbose/checked-cast (assert-enabled) builds; (2) the hardware-GDI path requires '/gdi:hw' plus a local X visual whose color format allocates a stage buffer (the preserved 24-bit Xvfb visual did not create one), so that oversized dwidth reaches freerdp_image_scale's destination-stride assertion. Limiting factors: exploitation needs victim-initiated connection to the malicious server (UI:P), high attack complexity (AC:H) and a passive attack requirement (AT:P), and the demonstrated aborts depend on specific build/visual/assert configurations rather than a default stock build; no live wire-to-abort session was preserved.

All signals point to a genuinely low-priority issue rather than a high-CVSS-but-overrated one - the inputs are internally consistent. The CVSS 4.0 base score is only 2.3 with AV:N/AC:H/AT:P/PR:N/UI:P and the sole impact being VA:L (client availability); there is no confidentiality or integrity impact, and the vuln.today decision label is 'monitor'. The flaw is a client-side denial of service: a malicious RDP server can abort an X11 FreeRDP client, not execute code (the conditional heap-write theory for optional SWSCALE/Cairo builds is explicitly stated as untested). This is not in CISA KEV, so exploitation status is 'no confirmed active exploitation'; a public PoC reference exists but it is not verified as working exploit code - only focused unit-style harnesses that bypass the RDPGFX wire parser, with no preserved full-session malicious-server replay. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The high attack complexity (AC:H), passive attack requirement (AT:P), and need for the victim to initiate a connection to an attacker-controlled server (UI:P) further depress real-world risk. Net: low priority - appropriate to patch on a normal cycle, not an emergency.

An attacker stands up or compromises an RDP server; when a victim connects an X11 FreeRDP client with RDPGFX enabled, the server creates a surface and then sends a MAPSURFACETOSCALEDOUTPUT PDU carrying oversized targetWidth/targetHeight/output-origin values, which FreeRDP stores unbounded and later feeds into a checked UINT16 cast or a freerdp_image_scale stride assertion, aborting the client. A public PoC reference exists but it is not verified as working exploit code - only focused harnesses were preserved, and the demonstrated aborts (exit 134) occurred in assert-enabled builds; no live full-session network trigger was observed. The high complexity and the requirement that the victim connect to the malicious server make this an opportunistic nuisance crash rather than a reliable remote attack.