FreeRDP EUVD-2026-98711

Exploitation requires the victim's FreeRDP client (version 3.11.0 up to but not including 3.32.0) to establish a connection to a malicious or compromised RDP server, and the RDPGFX graphics channel must negotiate the AVC444 or AVC444v2 codec. The server then sends an otherwise in-bounds region rectangle whose width is odd, which bypasses the missing even-width check before YUV444 conversion. Limiting factors that reduce real-world risk: the attacker must control the server side (not merely reach an exposed client port), the user must actively initiate/accept the connection (UI:P), AVC444/AVC444v2 must be in use, and the impact is confined to crashing that single client process - no persistence, data access, or code execution. Clients on 3.32.0 or later, or configurations where AVC444 is not negotiated, are not affected.

This is a denial-of-service-only vulnerability (CWE-617 reachable assertion) whose real-world risk is moderate and bounded. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VA:H with VC:N/VI:N) correctly captures the profile: network-reachable, low complexity, no privileges, but passive user interaction is required, and the ONLY impact is availability (the client aborts) - there is no confidentiality or integrity loss and no code execution. Critically, the attack vector is inverted from typical RDP flaws: the malicious party is the SERVER, and the victim is the connecting CLIENT, so exploitation depends on luring or compromising the server a FreeRDP client connects to, not on reaching an exposed listening service. No EPSS score, KEV listing, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict among the signals - all point to a genuine but low-urgency, crash-only issue. The 7.1 'high' rating is driven almost entirely by VA:H; for most defenders this is a stability/availability bug to patch on a normal cycle rather than an emergency, since the worst outcome is a terminated client session with no data exposure or system compromise.

A user connects their FreeRDP client to an RDP server that is attacker-controlled or has been compromised. After the RDPGFX channel negotiates AVC444/AVC444v2, the server sends an in-bounds region rectangle with an odd width; the missing even-width validation before YUV444 conversion reaches an assertion that aborts the client. No public exploit code is identified in the provided data, but the trigger is trivial for any party controlling the server side.