Executive brief
FreeRDP is a remote desktop protocol library used to enable remote desktop connections. A malicious RDP server can send specially crafted video frames that trigger an out-of-bounds memory read in the video decoding logic, potentially allowing information disclosure or service disruption to clients connecting through FreeRDP.
Technical details
The vulnerability is a heap out-of-bounds read in the general_ChromaV1ToYUV444 function within the YUV color conversion primitives (libfreerdp/primitives/prim_YUV.c). The flaw occurs during AVC444 chroma plane reconstruction when a malicious RDP server sends an RFX_AVC444_BITMAP_STREAM with crafted frame geometry that causes memory access past the allocated luma plane buffer. The attack requires an active RDP connection to a malicious server; no authentication bypass or client-side user interaction is needed. An attacker can read adjacent heap memory, potentially leaking sensitive data or causing a crash. The issue is fixed in FreeRDP 3.31.0 and later.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-03: disclosed