Executive brief
FreeRDP is a widely-used open-source implementation of the Remote Desktop Protocol used by RemoteApp clients to display applications from remote servers. A malicious RDP server can exploit an integer overflow to read arbitrary data from the client's memory, potentially exposing credentials, session tokens, or other sensitive information during icon rendering.
Technical details
The vulnerability is an integer overflow in the freerdp_image_copy_from_icon_data function within libfreerdp/codec/color.c. When calculating the required buffer size (nWidth × nHeight × bytes_per_pixel), the calculation occurs in 32-bit arithmetic and can wrap/overflow when a malicious RDP server sends a TS_ICON_INFO update with large dimensions (e.g., 32768×32768 at 32-bit color depth). This bypasses the cbBitsColor bounds check, allowing subsequent buffer read operations to access memory beyond the intended source buffer. The attack requires a connection to a malicious RDP server; RemoteApp clients using the vulnerable code path are affected, though xfreerdp has a separate mitigation. The issue is fixed in version 3.27.0.
Affected products
- FreeRDP FreeRDP prior to 3.27.0
Timeline
- 2026-08-19: disclosed
- 2026: patched: Fixed in version 3.27.0