Client-Side Heap Corruption Vulnerability in FreeRDP by FreeRDP
CVE-2026-111382

8.7HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111382?

The FreeRDP software prior to version 3.32.0 presents a client-side heap out-of-bounds write issue, particularly within the functions general_LumaToYUV444 and general_ChromaV2ToYUV444. This flaw allows malicious Remote Desktop Protocol (RDP) servers to send specially crafted RDPGFX AVC444 or AVC444v2 frames containing oddly-sized region rectangles, ultimately leading to the corruption of client memory. The exploitation of this vulnerability can result in heap corruption, raising the potential for arbitrary code execution on affected client systems.

Affected Version(s)

FreeRDP 0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.