FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
2. freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface
A flaw was found in FreeRDP.If a user connects to a malicious Remote Desktop (RDP) server, a security flaw in FreeRDP could cause the application to crash or allow the server to run unauthorized code on the user's system.
RHSA-2026:46393: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)
RHSA-2026:36203: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
Configurations
Workarounds
To mitigate this issue, users should avoid connecting to untrusted or unknown Remote Desktop Protocol (RDP) servers. Restricting FreeRDP client usage to only known and trusted RDP servers can reduce the risk of exploitation.