CVE-2026-109251: FreeRDP Buffer Overflow Vulnerability

CVE-2026-109251 Overview

CVE-2026-109251 is an out-of-bounds write vulnerability in FreeRDP versions prior to 3.32.0. The flaw affects the Microsoft Remote Desktop Protocol Extended Geometry Tracking (MS-RDPEGT) video pipeline. FreeRDP stores the server-supplied signed geometry origin unchecked in an unsigned video surface coordinate. The clamp inside gdiVideoShowSurface() wraps in 32-bit arithmetic and is bypassed. A malicious RDP server can send a negative topLevelLeft value to clients connected with /video, triggering an out-of-bounds write of decoded H.264 picture data or a client abort.

Critical Impact
A malicious RDP server can corrupt client memory or crash the FreeRDP client when video redirection is enabled, affecting availability and potentially integrity of the client process.

Affected Products

FreeRDP versions prior to 3.32.0
FreeRDP clients configured with the /video command-line option
Downstream applications and distributions bundling vulnerable FreeRDP libraries

Discovery Timeline

2026-10-12 - CVE-2026-109251 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109251

Vulnerability Analysis

The vulnerability resides in the FreeRDP video surface rendering path that processes MS-RDPEGT geometry messages. The protocol defines geometry origin coordinates as signed 32-bit integers. FreeRDP stores the server-controlled topLevelLeft value into an unsigned 32-bit video surface coordinate without validation. A negative value from the server becomes a very large unsigned integer after the conversion.

The subsequent clamp logic in gdiVideoShowSurface() performs arithmetic on these coordinates to constrain the blit region. Because the arithmetic executes in 32-bit unsigned space, the computation wraps and the clamp branch is skipped. The function proceeds to write decoded H.264 picture data outside the intended surface bounds. The condition maps to improper validation of array index [CWE-129].

Root Cause

The root cause is a signedness mismatch combined with missing bounds validation on attacker-controlled protocol fields. The signed MS-RDPEGT origin values are copied into unsigned storage without range checks. The resulting integer wrap defeats the clamp intended to prevent out-of-bounds access.

Attack Vector

Exploitation requires a victim to connect a FreeRDP client built with video support to a malicious or compromised RDP server using the /video option. The server crafts an MS-RDPEGT message containing a negative topLevelLeft value. The client then writes H.264 frame data outside the destination surface or terminates abnormally. User interaction is required to initiate the RDP session.

No verified exploit code is published. Technical specifics are described in the FreeRDP GitHub Security Advisory and the VulnCheck Advisory for FreeRDP.

Detection Methods for CVE-2026-109251

Indicators of Compromise

Unexpected FreeRDP client crashes or xfreerdp/wlfreerdp abort signals immediately after a video surface is created
Outbound RDP sessions to untrusted hosts initiated with the /video flag
Memory corruption traces or ASan reports referencing gdiVideoShowSurface in client logs

Detection Strategies

Inventory endpoints with FreeRDP installations and identify versions earlier than 3.32.0
Alert on process launches of xfreerdp or related binaries that include the /video argument against external destinations
Correlate RDP client process crashes with recent connections to new or unverified RDP servers

Monitoring Recommendations

Monitor outbound TCP/3389 and RDP gateway traffic from workstations running FreeRDP
Capture process command lines for FreeRDP clients to flag /video usage against untrusted servers
Forward FreeRDP crash telemetry and OS-level abort events to a centralized data lake for correlation

How to Mitigate CVE-2026-109251

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all client systems
Audit scripts, shortcuts, and applications that invoke FreeRDP with the /video option
Restrict outbound RDP connections to a defined allowlist of trusted servers

Patch Information

FreeRDP maintainers resolved the issue in version 3.32.0 by validating the signed MS-RDPEGT geometry origin before storing it in surface coordinates and ensuring the clamp in gdiVideoShowSurface() is honored. Refer to the FreeRDP GitHub Security Advisory for the fix commit and supported release branches.

Workarounds

Avoid using the /video option until the FreeRDP client is upgraded to 3.32.0 or later
Connect only to trusted RDP servers; treat unknown or user-supplied RDP endpoints as hostile
Where upgrade is delayed, deploy host-based firewall rules to restrict outbound RDP to approved destinations

bash

# Verify installed FreeRDP version and avoid vulnerable /video usage
xfreerdp --version

# Preferred: upgrade package (example for Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Interim workaround: launch without the /video option
xfreerdp /v:trusted-rdp.example.internal /u:user /cert:tofu