Executive brief
FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A security flaw allows a malicious or compromised RDP server to take control of a user's computer when they connect using specific, non-default settings. This could result in the theft of sensitive data, installation of malware, or a complete system takeover.
Technical details
A heap out-of-bounds write exists in FreeRDP's GDI layer within the gdi_Bitmap_Decompress function. When a client is launched with the '/cache:codec:rfx' flag, the software incorrectly passes the desktop surface stride and height as destination bounds to the RemoteFX (RFX) decoder, despite the destination buffer (bitmap->data) being allocated based on smaller wire dimensions. An attacker-controlled RDP server can send a Cache Bitmap V3 secondary drawing order with a specific codecID to trigger the overflow. By manipulating tile positions (xIdx/yIdx), an attacker can achieve an OOB write with controlled offsets and content, which has been demonstrated to allow for a forward-edge control-flow hijack (controlled $pc). The issue is resolved in version 3.27.1.
Affected products
- FreeRDP FreeRDP >= 2.0.0, < 3.27.1
Timeline
- 2026-06-16: patched: Fixes merged into master branch
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD