CVE-2026-109946
A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.33% probability · 25th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-617
- Affected
- freerdp/freerdp
- Source
- disclosure@vulncheck.com
EPSS moved from 0.3% on 14 October 2026 to 0.3% on 26 October 2026.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrvExploit, Vendor Advisory
- https://www.vulncheck.com/advisories/freerdp-3.11.0-before-3.32.0-reachable-assertion-via-avc444-odd-region-widthThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrvExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.