CVE-2026-109251
Received Received - Intake

FreeRDP Video Surface Out-of-Bounds Write via Negative Geometry Origin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109251
EUVD
EUVD-2026-97695

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.0 has a flaw where it fails to validate a server-supplied geometry origin value before storing it in an unsigned video surface coordinate. This causes the blit clamp in gdiVideoShowSurface() to skip due to 32-bit arithmetic wrapping, allowing a malicious RDP server to send a negative value that triggers an out-of-bounds write of H.264 video data or causes the client to abort.

Detection Guidance

Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. If version is below 3.32.0, the system is vulnerable. Monitor network traffic for RDP connections using /video flag, as this is required for exploitation.

Impact Analysis

If you use FreeRDP versions before 3.32.0 with the /video option enabled, a malicious RDP server could crash your client application or corrupt memory by writing H.264 video data to unintended locations. This could lead to denial of service or potential further exploitation depending on your system configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access or data corruption during RDP sessions. A malicious server could exploit the flaw to write data to unintended memory locations, potentially leading to data leaks or integrity issues. However, the specific impact depends on how FreeRDP is used in the environment.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable the /video flag in RDP connections if not required. Block untrusted RDP servers at the network level until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart