Out-of-Bounds Read in FreeRDP's H.264 Compression Functionality
CVE-2026-24677

8.7HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
9 February 2026

What is CVE-2026-24677?

An implementation flaw in FreeRDP prior to version 3.22.0 allows the ecam_encoder_compress_h264 function to trust server-defined dimensions without validating the source buffer size. This oversight can lead to an out-of-bounds read in the sws_scale function, potentially exposing sensitive data or enabling further exploitation by attackers. Users are advised to upgrade to version 3.22.0 or later to mitigate this vulnerability.

Affected Version(s)

FreeRDP < 3.22.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/d2d4f449312ddaf...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.