Integer Overflow in FreeRDP Leading to Heap Buffer Overflow

Executive Summary

CVE-2026-121950 is a heap overflow vulnerability in FreeRDP versions before 3.32.2. It occurs when handling an RDPGFX CREATE_SURFACE PDU. The client fails to check the product of surface dimensions in the gdi_CreateSurface function. This causes an integer wrap, leading to a heap buffer overflow on 32-bit builds or a 4 GiB allocation on 64-bit builds. An attacker can exploit this by sending a malicious PDU with width and height set to 32766.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. Run: freerdp2-shadow --version or apt show freerdp2. If the version is below 3.32.2, the system is vulnerable. Monitor network traffic for RDPGFX CREATE_SURFACE PDUs with width and height set to 32766.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious RDP server to corrupt heap memory on 32-bit systems or cause a denial of service on 64-bit systems. It requires the victim to use a FreeRDP client with RDPGFX dynamic virtual channel and software GDI decoding enabled. The attack involves connecting to a compromised server that sends a specially crafted PDU.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.2 or later. Disable the RDPGFX dynamic virtual channel and software GDI decoding if not required. Restrict RDP connections to trusted servers only.

Useful 0 Not Useful 0