PT-2026-25332 · Freerdp · Freerdp

Ehdgks0627

·

Published

2026-01-01

·

Updated

2026-05-22

·

CVE-2026-29774

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0
Description FreeRDP is a free implementation of the Remote Desktop Protocol. A client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. The issue stems from unchecked pointer arithmetic when computing destination pointers using rect->left, potentially allowing writes beyond the allocated heap region. A malicious server can trigger this by sending a WIRE TO SURFACE PDU 1 with an AVC420 codec containing a regionRects entry where left exceeds the surface width. The vulnerable code is located in yuv.c within the clamp() function (line 347) and the avc420 yuv to rgb function (line 67). The clamp() function only validates top/bottom against the surface height, but does not check left/right against the surface width.
Recommendations Update FreeRDP to version 3.24.0 or later.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

Related Identifiers

BDU:2026-04138
CVE-2026-29774
GHSA-5Q35-HV9X-7794
OESA-2026-2439
OESA-2026-2440
OESA-2026-2441
OESA-2026-2442
OPENSUSE-SU-2026:10408-1
OPENSUSE-SU-2026:20657-1
SUSE-SU-2026:1632-1
SUSE-SU-2026:1633-1
SUSE-SU-2026:1634-1
SUSE-SU-2026:1635-1
SUSE-SU-2026:1640-1
SUSE-SU-2026:21436-1

Affected Products

Freerdp