CVE-2026-111381

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file.

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing heap over-reads, title corruption, or client crashes.

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client. A malicious RDP server can request unadvertised camera media types by sending a StartStreamsRequest with oversized dimensions, forcing large allocations and reconfiguring the local camera via the HAL.

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport. A malicious gateway can send zero-length pings, causing a nullptr stream to be passed to websocket_reply_close and crashing the client.

FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).