Heap Out-of-Bounds Read in FreeRDP AVC444 Processing

Executive Summary

CVE-2026-85090 is a heap out-of-bounds read vulnerability in FreeRDP versions before 3.31.0. It occurs in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a specific RFX_AVC444_BITMAP_STREAM with frame geometry that triggers reading memory past the allocated luma plane buffer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is below 3.31.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a malicious RDP server to cause a denial of service by crashing the client or leak sensitive memory data. In severe cases, it might cause color artifacts on the screen or crash the client application if the read crosses a page boundary.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. This can be done via package managers like apt, yum, or by compiling from source. Ensure all remote desktop clients and servers are updated to prevent exploitation.

Useful 0 Not Useful 0