CVE-2026-44421: FreeRDP Buffer Overflow Vulnerability

CVE-2026-44421 Overview

CVE-2026-44421 is a heap buffer overflow vulnerability [CWE-122] in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can trigger an out-of-bounds heap write in the FreeRDP client by sending crafted Remote Desktop Protocol Graphics Pipeline (RDPGFX) PDUs. The flaw resides in the gdi_CacheToSurface function, which validates a destination rectangle clamped to UINT16_MAX but then performs the copy using the original cacheEntry->width and cacheEntry->height values. The vulnerability is reachable only when the client has RDPGFX enabled. FreeRDP version 3.26.0 fixes the issue.

Critical Impact

A malicious RDP server can write outside heap bounds in a connecting client, causing crashes or arbitrary code execution within the FreeRDP client process.

Affected Products

• FreeRDP versions prior to 3.26.0
• RDP clients built on the FreeRDP library with RDPGFX enabled
• Downstream applications and distributions bundling vulnerable FreeRDP releases

Discovery Timeline

• 2026-05-29 - CVE-2026-44421 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-44421

Vulnerability Analysis

The vulnerability exists in the gdi_CacheToSurface routine within the FreeRDP graphics pipeline handler. When the client processes an RDPGFX CacheToSurface PDU, it validates the destination rectangle by clamping coordinates to UINT16_MAX. The subsequent copy operation ignores the clamped values and uses the unvalidated cacheEntry->width and cacheEntry->height fields supplied through the protocol stream. A mismatch between validated bounds and actual copy dimensions produces a large out-of-bounds heap write into the destination surface buffer. Because the write size and content are attacker-influenced, exploitation can corrupt adjacent heap structures and yield client-side code execution under the privileges of the connected user.

Root Cause

The root cause is inconsistent boundary enforcement. The validation step clamps the rectangle to a safe upper bound, but the memory copy uses original, attacker-controlled dimensions from cacheEntry. This logic gap allows oversized writes that exceed the allocated surface buffer.

Attack Vector

Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server with the RDPGFX channel enabled. User interaction is required to establish the session. Common attack scenarios include phishing links containing .rdp files, malicious connection brokers, or compromised remote desktop gateways. Once connected, the server sends crafted RDPGFX PDUs containing oversized cacheEntry dimensions to trigger the overflow.

No public proof-of-concept exploit is available. See the FreeRDP GitHub Security Advisory GHSA-p6r2-4hgm-m6ff for technical details of the patched code path.

Detection Methods for CVE-2026-44421

Indicators of Compromise

• Unexpected crashes of FreeRDP-based clients (xfreerdp, wlfreerdp, Remmina, GNOME Connections) shortly after connecting to an RDP host
• Outbound RDP sessions (TCP/3389) initiated to untrusted external IP addresses or domains
• .rdp configuration files dropped via email, chat, or download with hostnames pointing to non-corporate infrastructure
• Core dumps or segmentation faults from FreeRDP processes referencing gdi_CacheToSurface in the call stack

Detection Strategies

• Inventory installed FreeRDP packages across Linux, macOS, and Windows endpoints and flag versions below 3.26.0
• Monitor process telemetry for FreeRDP client crashes correlated with active RDP sessions
• Inspect network flows for RDP connections to destinations outside approved jump hosts or remote desktop gateways
• Hunt for .rdp files arriving via email gateways or web downloads and review their full address fields

Monitoring Recommendations

• Enable endpoint behavioral telemetry to capture child process crashes and heap corruption events for RDP client binaries
• Forward FreeRDP application logs to a centralized SIEM for correlation with network connection events
• Alert on RDP outbound connections from user workstations to non-RFC1918 addresses that are not on an allowlist
• Track package management events for FreeRDP installs and updates across managed Linux distributions

How to Mitigate CVE-2026-44421

Immediate Actions Required

• Upgrade FreeRDP to version 3.26.0 or later on every system running a FreeRDP-based client
• Audit third-party applications and Linux distributions that bundle FreeRDP and apply vendor-supplied updates
• Restrict outbound RDP connections to a defined allowlist of trusted servers and gateways
• Train users to avoid opening .rdp files received from untrusted sources

Patch Information

The FreeRDP maintainers fixed the vulnerability in version 3.26.0. The patch enforces consistent boundary checks in gdi_CacheToSurface so that the copy operation uses validated dimensions. Patch details are published in the FreeRDP GitHub Security Advisory GHSA-p6r2-4hgm-m6ff.

Workarounds

• Disable the RDPGFX channel at the client when connecting to untrusted hosts, since the vulnerability is only reachable when RDPGFX is enabled
• Route all RDP traffic through a hardened remote desktop gateway that terminates and reissues sessions to trusted servers only
• Block outbound TCP/3389 at egress firewalls for user populations that do not require direct RDP

# Disable the RDP Graphics Pipeline channel on the FreeRDP command line
xfreerdp /v:trusted-host.example.com /u:alice /gfx:off /gfx-h264:off

# Verify installed FreeRDP version (Debian/Ubuntu)
dpkg -l | grep -i freerdp

# Verify installed FreeRDP version (RHEL/Fedora)
rpm -qa | grep -i freerdp