FreeRDP: Heap out-of-bounds write in AVC444 YUV444 processing
Summary
FreeRDP before 3.32.0 contains a heap out-of-bounds write in the AVC444 and AVC444v2 YUV444 conversion functions general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send crafted RDPGFX frames with odd-height region rectangles that end at the surface height, so the client writes one row past the U and V planes. This can corrupt heap memory and may lead to code execution on the client. The user must connect to the attacker-controlled server, so the risk applies mainly to clients that connect to untrusted or third-party RDP hosts.
Affected
- FreeRDP before 3.32.0 (CNA range: 0 to below 3.32.0)
- Versions 2.x: status not confirmed by the vendor; Ubuntu lists freerdp2 as needing evaluation. Unknown.
Fixed in
- FreeRDP 3.32.0 (released 23 Sept 2026)
- Ubuntu freerdp3 3.32.0+dfsg-0ubuntu0.26.04.1 (26.04 LTS) and 3.32.0+dfsg-0ubuntu0.24.04.1 (24.04 LTS)
- Ubuntu 26.10 freerdp3: not affected
Workaround
Unknown. No workaround is documented in the sources reviewed.
Exploitation
- No known exploitation in the wild found in the sources reviewed.
- No public proof of concept found; GitHub exploit repositories were not checked directly.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- Not verified against the CISA KEV catalogue.
Our recommendation
- Update FreeRDP to 3.32.0 or a fixed distribution package wherever FreeRDP clients are used, prioritising Linux desktops and remote-access jump hosts.
- Confirm the status of FreeRDP 2.x packages with your distribution.
- Until patched, connect only to RDP servers you trust and avoid RDP sessions started from unsolicited links or attachments.
- Inventory all FreeRDP clients and their versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f4pf-pgp4-f2r3 github.com
- VulnCheck advisory: FreeRDP before 3.32.0 heap out-of-bounds write www.vulncheck.com
- Ubuntu security notice CVE-2026-111382 ubuntu.com
- FreeRDP 3.32.0 release notes www.freerdp.com
- VulDB entry CVE-2026-111382 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:23.
Original description (NVD)
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.