Heap Buffer Overflow in FreeRDP Affects Remote Desktop Protocol Handling

CVE-2026-121950

What is CVE-2026-121950?

A vulnerability exists in FreeRDP versions prior to 3.32.2 that allows an attacker to exploit an unchecked surface dimension during the processing of RDPGFX CREATE_SURFACE PDUs. This flaw can lead to an integer wrap and subsequent heap buffer overflow, allowing a malicious RDP server to send specially crafted CREATE_SURFACE PDUs with dimensions of 32766, which can corrupt the client's heap memory or induce a denial of service. This issue is particularly impactful as it affects both 32-bit and 64-bit builds differently, potentially resulting in large memory allocations that can destabilize client applications.

References