PT-2026-25335 · Freerdp+1 · Freerdp+1
Wooseokdotkim
·
Published
2026-01-01
·
Updated
2026-04-25
·
CVE-2026-31806
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.24.0
Description
FreeRDP is an implementation of the Remote Desktop Protocol. The
gdi surface bits() function handles SURFACE BITS COMMAND messages from the RDP server. When using NSCodec, the bmp.width and bmp.height values are not validated against desktop dimensions. A malicious RDP server can send crafted bmp.width and bmp.height values exceeding the expected surface size. This can lead to a heap buffer overflow because these values are used during bitmap decoding and memory operations without proper bounds checking. An attacker controlling the pixel data can potentially overwrite adjacent heap memory.Recommendations
Versions prior to 3.24.0 should be updated to version 3.24.0 or later.
Exploit
Fix
DoS
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freerdp
Rocky Linux