Junglewise Threat Intelligence

CVE-2026-23532: FreeRDP heap buffer overflow in gdi_SurfaceToSurface

CVE-2026-23532 · Severity: critical · CVSS 9.8 · Published 2026-01-19

Technologies: FreeRDP. Vendors: FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A security flaw in the client software allows a malicious server to trigger a memory overflow on the user's computer. This could lead to the application crashing or, in more severe cases, allow the attacker to execute unauthorized code on the user's system.

Technical details

A heap-based buffer overflow exists in FreeRDP's `gdi_SurfaceToSurface` function within `libfreerdp/gdi/gfx.c`. The vulnerability is caused by a logic error where the destination rectangle is clamped using `MAX_UINT16`, but the subsequent `freerdp_image_copy` operation uses the original, unclamped width and height values. An attacker controlling a malicious RDP server can send a specially crafted SurfaceToSurface PDU that exceeds surface boundaries, leading to an out-of-bounds write. This can result in a denial of service (crash) or potential heap corruption leading to arbitrary code execution. The issue is addressed in version 3.21.0.

Affected products

  • FreeRDP FreeRDP < 3.21.0

Timeline

  • 2026-01-19: advisory
  • 2026-01-19: patched

References

Related threats