CVE-2026-67290: FreeRDP Buffer Overflow Vulnerability

CVE-2026-67290 Overview

CVE-2026-67290 is a heap out-of-bounds read vulnerability in FreeRDP versions prior to 3.29.0. The flaw resides in the Terminal Services Multimedia Redirection (TSMF) FFmpeg decoder when parsing AVC1MPEG2VIDEOINFO media types. When a server sends malformed media format data with insufficient ExtraData, the client reads fixed offsets without validating source buffer length. This triggers an out-of-bounds read on the heap, classified under [CWE-125]. The vulnerability affects RDP client deployments that connect to untrusted servers, allowing a malicious server to crash the client process.

Critical Impact
A malicious RDP server can send crafted media format data to trigger a heap out-of-bounds read in the FreeRDP client, resulting in denial of service through process crash.

Affected Products

FreeRDP versions before 3.29.0
Applications embedding the FreeRDP TSMF channel with FFmpeg decoder support
RDP clients built on FreeRDP libraries (e.g., Remmina, Weston RDP backend)

Discovery Timeline

2026-08-01 - CVE-2026-67290 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67290

Vulnerability Analysis

The vulnerability exists in the TSMF (Terminal Services Multimedia Redirection) channel handler within FreeRDP. TSMF allows a server to redirect multimedia content to the client for local decoding through FFmpeg. When the server sends MPEG2VIDEOINFO structures describing AVC1-encoded streams, the client parses the associated ExtraData field to configure the FFmpeg decoder context.

The parser reads fixed byte offsets from the ExtraData buffer without verifying that the buffer contains enough bytes. When the server sends a truncated ExtraData field, the read operation exceeds the allocated heap buffer boundary. The result is a client-side denial of service, and depending on adjacent heap contents, potential information disclosure through side channels.

EPSS data reports a score of 0.432% at the 35.5 percentile, indicating low near-term exploitation probability. However, RDP clients frequently connect to untrusted or attacker-controlled servers, making the attack surface practical.

Root Cause

The root cause is missing input validation on server-supplied media format data. The TSMF FFmpeg decoder assumes the ExtraData buffer contains a minimum number of bytes matching the MPEG2VIDEOINFO/AVC1 layout. No length check precedes the fixed-offset reads, so a malicious or malformed value causes the parser to read beyond the allocated heap region.

Attack Vector

Exploitation requires the victim to initiate an RDP session to a server controlled by the attacker. The attacker enables the TSMF dynamic virtual channel and sends a malformed TS_AM_EXCHANGE_CAPABILITY_REQUEST or subsequent media format descriptor with truncated ExtraData. No user interaction beyond establishing the RDP connection is required, and no authentication on the target client is needed since the server drives the exchange.

// Patch excerpt from the FreeRDP resource-limits pull request
// channels/rail/rail_common.c - length validation before further parsing

Stream_Read_UINT16(s, *orderType);   /* orderType (2 bytes) */
Stream_Read_UINT16(s, *orderLength); /* orderLength (2 bytes) */

if (*orderLength < RAIL_PDU_HEADER_LENGTH)
{
    WLog_ERR(TAG, "invalid order length %" PRIu16 " < RAIL_PDU_HEADER_LENGTH(%u)",
             *orderLength, RAIL_PDU_HEADER_LENGTH);
    return ERROR_INVALID_DATA;
}

if (!Stream_CheckAndLogRequiredLength(TAG, s, *orderLength - RAIL_PDU_HEADER_LENGTH))
    return ERROR_INVALID_DATA;

if (*orderLength > RAIL_PDU_MAX_LENGTH)
{
    WLog_ERR(TAG, "invalid order length %" PRIu16 " < RAIL_PDU_MAX_LENGTH(%llu)",
             *orderLength, RAIL_PDU_MAX_LENGTH);
    return ERROR_INVALID_DATA;
}

return CHANNEL_RC_OK;

Source: FreeRDP commit 8d3b860. The patch introduces explicit minimum and maximum length checks alongside Stream_CheckAndLogRequiredLength guards. The same resource-limits pull request adds equivalent bounds validation to the TSMF media format parser.

Detection Methods for CVE-2026-67290

Indicators of Compromise

Unexpected FreeRDP client process crashes or SIGSEGV signals during RDP sessions that involve multimedia redirection
RDP sessions to unfamiliar or untrusted external servers with the TSMF dynamic virtual channel negotiated
Core dumps referencing FFmpeg decoder functions such as avcodec_open2 or heap reads within TSMF handlers

Detection Strategies

Inventory endpoints running FreeRDP builds older than 3.29.0 using software asset management tooling
Inspect RDP client telemetry for repeated abnormal termination events correlated with outbound connections to untrusted RDP hosts
Monitor for the presence of the TSMF static virtual channel in RDP session negotiation logs where policy does not require multimedia redirection

Monitoring Recommendations

Log outbound TCP connections to port 3389 and correlate them with FreeRDP process telemetry
Enable crash reporting on Linux desktops and route coredump events to a central log platform for review
Alert on RDP sessions initiated to external, non-corporate IP ranges by developer or user workstations

How to Mitigate CVE-2026-67290

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all managed endpoints and container images
Rebuild and redistribute any downstream applications that statically link or vendor the FreeRDP libraries
Restrict outbound RDP connectivity to trusted internal servers via firewall or egress proxy rules

Patch Information

The fix is committed in FreeRDP repository commit 8d3b86022f0d71aefa7bd2e466d2d391693a41b3 and is released in version 3.29.0. Details are published in the FreeRDP GitHub Security Advisory GHSA-whq8-c3v3-p8v8 and the VulnCheck advisory on FreeRDP. Distribution maintainers should backport the patch to supported LTS branches.

Workarounds

Disable the TSMF dynamic virtual channel in FreeRDP client configuration by omitting /multimedia or setting /dynamic-channel:-tsmf at the command line
Build FreeRDP without FFmpeg support if multimedia redirection is not required in the environment
Enforce policy that limits RDP client usage to internally hosted, trusted servers only

bash

# Launch FreeRDP with TSMF multimedia redirection disabled
xfreerdp /v:rdp.example.internal /u:username \
         /dynamic-channel:-tsmf \
         -multimedia

# Verify installed FreeRDP version meets the patched release
xfreerdp --version | awk '{print $2}'
# Expected output: 3.29.0 or later