Description

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T13:06:20.430Z",
  "pubdate": "2026-09-03T13:06:20.430Z",
  "executiveSummary": "FreeRDP versions prior to 3.31.0 are susceptible to a heap out-of-bounds read vulnerability located within the AVC444 chroma plane reconstruction logic.\nThe vulnerability resides in the general_ChromaV1ToYUV444 function, which processes RFX_AVC444_BITMAP_STREAM data.\nBy manipulating the frame geometry within a malicious RDP stream, a remote attacker can induce the application to perform an unauthorized memory read beyond the boundaries of the allocated luma plane buffer.\nThis vulnerability is triggered when a client connects to a malicious or compromised RDP server, necessitating no specific user interaction beyond the initiation of the remote desktop session.\nThe impact primarily involves information disclosure, as the read operation may leak sensitive data residing on the heap, potentially assisting in further exploitation efforts such as bypassing Address Space Layout Randomization (ASLR).\nRisk implications are elevated given the ubiquity of RDP clients, though successful exploitation depends on the attacker's ability to control frame geometry parameters to influence heap offsets.",
  "technicalDetails": "The vulnerability is rooted in an insufficient boundary check during the processing of AVC444 chroma planes within the general_ChromaV1ToYUV444 function of FreeRDP. This function is responsible for reconstructing YUV444 color spaces from incoming RemoteFX (RFX) AVC444 bitmap streams.\nThe root cause stems from a discrepancy between the allocated memory for the luma plane and the index calculation logic used when processing the chroma components. When a server provides a specifically crafted RFX_AVC444_BITMAP_STREAM, it can manipulate frame dimensions and offsets in a way that causes the decompression loop or the reconstruction logic to access memory addresses outside the legitimate bounds of the luma plane buffer.\nAttack Flow: 1. The victim client connects to an RDP server controlled by an attacker. 2. The malicious server sends a specially crafted RFX_AVC444_BITMAP_STREAM containing manipulated frame geometry headers. 3. Upon receiving this data, the FreeRDP client invokes the general_ChromaV1ToYUV444 function to reconstruct the image for display. 4. Due to the lack of validation on the provided geometry parameters, the function calculates read pointers that extend into adjacent heap memory regions. 5. The function reads from this out-of-bounds memory, potentially including the read data in the reconstructed bitmap or causing a crash if the pointer hits unmapped memory.\nThe vulnerability occurs within the client-side component of the RDP implementation. No authentication is required for the server to send this malicious stream once a session is established, making it a critical concern for users connecting to untrusted or compromised remote infrastructure. The memory corruption is effectively a read-only primitive; however, in a sophisticated exploit chain, an attacker could leverage the disclosure of heap content to identify memory layouts, facilitating subsequent code execution attacks.\nThe affected versions include all FreeRDP releases prior to 3.31.0. The vulnerability is triggered by network-delivered payloads, meaning exposure is limited to clients that connect to attacker-controlled RDP servers. Post-exploitation, the attacker may obtain fragments of sensitive data stored on the client's heap, which could contain cryptographic keys, session tokens, or other sensitive runtime information."
}