CVE-2026-111382 Overview
CVE-2026-111382 is a client-side heap out-of-bounds write vulnerability [CWE-787] in FreeRDP versions prior to 3.32.0. The flaw resides in the general_LumaToYUV444 and general_ChromaV2ToYUV444 functions used to process RemoteFX Graphics Pipeline (RDPGFX) AVC444 and AVC444v2 video frames. A malicious Remote Desktop Protocol (RDP) server can send crafted frames with odd-height region rectangles ending at the surface height, causing the client to write past the U and V plane buffers. The resulting heap corruption can lead to arbitrary code execution on the connecting client.
Critical Impact
A malicious RDP server can corrupt FreeRDP client heap memory and potentially execute code when a user connects to it.
Affected Products
- FreeRDP versions prior to 3.32.0
- Applications and distributions bundling vulnerable FreeRDP libraries
- RDP clients built on libfreerdp for Linux, macOS, and Windows
Discovery Timeline
- 2026-10-16 - CVE-2026-111382 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-111382
Vulnerability Analysis
FreeRDP implements AVC444 and AVC444v2 video decoding to support the RDPGFX H.264 streaming extension. The general_LumaToYUV444 and general_ChromaV2ToYUV444 routines combine luma and chroma planes into a full YUV444 surface for rendering. These functions assume region rectangles align to even-height boundaries when writing chroma samples to the U and V planes.
When a server supplies a region rectangle whose height is odd and whose bottom edge coincides with the surface height, the chroma combine logic computes an output offset that extends one row beyond the allocated U and V plane buffers. The function then writes attacker-controlled pixel data to that location, producing a linear heap out-of-bounds write.
Root Cause
The root cause is missing boundary validation on the region rectangle height before computing chroma plane write offsets. The code paths treat the lower edge of the rectangle as valid without verifying that the derived chroma row index stays within the allocated U/V plane dimensions. Odd-height rectangles ending at surface height bypass the implicit even-row assumption used by the YUV444 combine math.
Attack Vector
Exploitation requires a victim to initiate an RDP connection to an attacker-controlled server. The attack vector is network-based and requires user interaction to establish the session. Once connected, the malicious server negotiates the RDPGFX dynamic virtual channel and advertises AVC444 or AVC444v2 codec support. The server then transmits crafted H.264 frames paired with region rectangles of odd height that terminate at the surface boundary. The FreeRDP client processes the frames and writes beyond the U/V plane allocations, corrupting adjacent heap metadata or object pointers. Attackers can leverage this primitive to influence control flow and potentially achieve code execution in the client process context.
No public proof-of-concept exploit is available at the time of publication. Refer to the FreeRDP GitHub Security Advisory GHSA-f4pf-pgp4-f2r3 and the VulnCheck Advisory on FreeRDP for additional technical detail.
Detection Methods for CVE-2026-111382
Indicators of Compromise
- FreeRDP client process crashes or heap corruption aborts during or shortly after an RDP session connection
- RDP sessions to untrusted or unexpected destination hosts, especially on non-standard TCP ports
- RDPGFX AVC444 or AVC444v2 codec negotiation followed by immediate client termination or anomalous child process creation
Detection Strategies
- Inventory endpoints and server workloads for FreeRDP installations and library versions below 3.32.0
- Monitor process telemetry for unexpected child processes spawned by FreeRDP client binaries such as xfreerdp or wlfreerdp
- Correlate outbound TCP 3389 connections from workstations with user-initiated RDP activity to identify suspicious destinations
Monitoring Recommendations
- Enable heap integrity checks and crash reporting on hosts running FreeRDP to capture exploitation attempts
- Log RDP client connection destinations and alert on connections to IP addresses outside sanctioned ranges
- Review EDR telemetry for memory access violations originating in libfreerdp modules
How to Mitigate CVE-2026-111382
Immediate Actions Required
- Upgrade FreeRDP to version 3.32.0 or later on all affected clients and bundled applications
- Restrict outbound RDP connectivity from end-user workstations to approved internal destinations only
- Instruct users not to initiate RDP sessions to untrusted or unknown servers until patching is complete
Patch Information
The FreeRDP project addressed the issue in release 3.32.0. Patch details and backport guidance are published in the FreeRDP GitHub Security Advisory GHSA-f4pf-pgp4-f2r3. Downstream Linux distributions and applications embedding libfreerdp should rebuild against the fixed version.
Workarounds
- Disable the RDPGFX AVC444 and AVC444v2 codecs on FreeRDP clients where configuration options permit
- Use network segmentation and egress filtering to block RDP traffic to untrusted external hosts
- Prefer RDP sessions to known, authenticated enterprise servers until all clients are patched
# Example: disable graphics pipeline and AVC codecs when launching xfreerdp
xfreerdp /v:<server> /gfx:off /gfx-h264:off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
