Executive brief
FreeRDP is a widely-used open-source implementation of the Remote Desktop Protocol used by administrators and users to remotely connect to Windows and Linux systems. A malicious RDP server can exploit a buffer overflow in H.264 video decoding to crash connecting clients or execute arbitrary code on their machines, potentially giving an attacker full control of the victim's computer.
Technical details
The vulnerability is a heap buffer overflow in the avc444_ensure_buffer function within libfreerdp/codec/h264.c. When FreeRDP clients negotiate RDPGFX AVC444 with H.264 decoder backend, the code uses 32-bit arithmetic to calculate YUV444 buffer allocation sizes, causing integer overflow when a malicious server supplies large surface dimensions. The piDstStride multiplied by padDstHeight can wrap to a small value, leading winpr_aligned_recalloc to allocate an undersized buffer. Subsequent writes via YUV420CombineToYUV444 using the actual dimensions overflow the buffer, corrupting the heap. No authentication is required—the attack occurs during the negotiation phase of a normal RDP connection. This can result in denial of service or arbitrary code execution. The issue was fixed in version 3.27.0 by correcting the bounds checking logic.
Affected products
- FreeRDP FreeRDP prior to 3.27.0
Timeline
- 2026-08-19: disclosed
- 2026-06-11: patched: Fix merged in FreeRDP 3.27.0