CVE-2026-44421: FreeRDP Heap Buffer Overflow in RDPGFX (CVSS 8.8)

Technical summary

The vulnerability resides in the gdi_CacheToSurface function within FreeRDP's graphics processing pipeline. The flaw stems from an inconsistency in bounds checking: the code validates a destination rectangle and clamps coordinates to UINT16_MAX, but subsequently uses the original unclamped cache entry dimensions for the actual memory copy operation. This mismatch allows an attacker to write beyond allocated heap boundaries when RDPGFX (Remote Desktop Protocol Graphics) extensions are active. The issue is classified as a heap-based buffer overflow (CWE-122 and CWE-787), enabling substantial out-of-bounds writes that can corrupt adjacent heap structures and potentially achieve code execution.

Business impact

Organizations using FreeRDP for remote access infrastructure face both operational and security risks. A compromised FreeRDP client session could expose sensitive data accessed or transmitted through the remote desktop, disrupt business continuity through client crashes, and potentially serve as a pivot point for lateral movement if the compromised endpoint holds privileged credentials. Open-source adoption of FreeRDP in enterprise tooling, containerized environments, and custom RDP solutions amplifies exposure. The requirement that RDPGFX be enabled limits but does not eliminate risk, as graphics acceleration is commonly enabled for user productivity.

Affected systems

FreeRDP versions prior to 3.26.0 are vulnerable. This includes all 3.x releases before 3.26.0 and earlier major versions. Affected systems include FreeRDP clients deployed across Linux, Windows, and Unix-like systems; applications embedding FreeRDP as a library; remote desktop gateways or proxies relying on FreeRDP for client-side rendering; and containerized deployments of FreeRDP-based services. Users running FreeRDP 3.26.0 or later are not affected. Verify your installed version against vendor release notes.

Exploitability

Exploitation requires a user to connect to an attacker-controlled or compromised RDP server with RDPGFX enabled. No pre-authentication or special privileges are needed on the attacker side, and the network is directly reachable from the internet in many deployments. The attack is deterministic—crafted RDPGFX PDUs reliably trigger the overflow—though achieving reliable code execution may require heap manipulation and platform-specific techniques. The user interaction barrier is minimal in scenarios where remote access is routine or where connection requests can be socially engineered. This vulnerability has not been observed in active exploitation campaigns to date, but the technical requirements for weaponization are straightforward.

Remediation

Upgrade FreeRDP to version 3.26.0 or later. Patch installation is the definitive mitigation. Organizations unable to patch immediately should disable RDPGFX if operationally feasible, restrict RDP server connections to trusted internal systems, and enforce network segmentation to limit exposure. Monitor for unexpected client crashes or suspicious process behavior on systems running FreeRDP. Audit which applications and services depend on FreeRDP to prioritize patching efforts.

Patch guidance

Consult the official FreeRDP project releases and your distribution's package repository for version 3.26.0 and later. Verify patch authenticity through official FreeRDP channels (GitHub releases, signed git tags, or vendor security advisories). For embedded or custom deployments, rebuild and redeploy with the patched FreeRDP library. Test patched versions in a non-production environment first to confirm compatibility with existing workflows. Organizations maintaining custom builds should review the FreeRDP project's commit history and security patches between your current version and 3.26.0.

Detection guidance

Monitor system logs for FreeRDP client crashes, segmentation faults, or abnormal process termination during or shortly after RDP connections. Network detection is challenging without traffic inspection, but anomalous RDPGFX PDU sizes or malformed packets may be observable on monitored RDP channels. Host-based memory protection mechanisms (e.g., AddressSanitizer if compiled in, or OS-level heap guards) can catch exploitation attempts. Review process dumps or core files from crashed FreeRDP clients for evidence of heap corruption. Track FreeRDP version inventory across your environment to identify unpatched deployments.

Why prioritize this

This vulnerability merits urgent patching due to its CVSS 3.1 score of 8.8 (HIGH), direct path from network-unauthenticated attacker to user system, potential for code execution, and straightforward trigger mechanism. The user-interaction requirement and RDPGFX dependency moderate but do not eliminate risk in environments where remote desktop use is prevalent. Prioritize patching for FreeRDP instances exposed to untrusted networks, followed by internal or air-gapped deployments.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity: a network-reachable, unauthenticated attack vector (AV:N, PR:N) with low attack complexity (AC:L) that impacts confidentiality, integrity, and availability (C:H, I:H, A:H). The UI:R requirement (user interaction required to establish an RDP connection) prevents a perfect 9.8 score but remains a practical constraint in many remote access scenarios. The score does not account for real-world factors like RDPGFX enablement prevalence or active exploitation, but reflects the severity of successful compromise.

Frequently asked questions