PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44421 FreeRDP CVE debrief

A heap-buffer-overflow vulnerability exists in FreeRDP client versions prior to 3.26.0. The flaw resides in the `gdi_CacheToSurface` function, where a destination rectangle is validated after being clamped to UINT16_MAX, but the subsequent copy operation uses the original `cacheEntry->width/height` values. This mismatch allows a malicious RDP server to trigger an out-of-bounds heap write when the client has RDPGFX enabled. The vulnerability can lead to client crashes or potential code execution. The issue was fixed in FreeRDP version 3.26.0.

Vendor
FreeRDP
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-27
Advisory published
2026-05-29
Advisory updated
2026-07-27

Who should care

Organizations using FreeRDP clients for remote desktop connectivity, particularly those connecting to untrusted or externally-facing RDP servers. Security teams monitoring client-side RDP attack surfaces. Infrastructure administrators managing Linux-based thin clients or remote access workstations using FreeRDP.

Technical summary

The vulnerability is a heap-based buffer overflow (CWE-122) in FreeRDP's graphics device interface. The `gdi_CacheToSurface` function performs insufficient bounds checking: it clamps the destination rectangle to UINT16_MAX for validation purposes, but then uses the unclamped `cacheEntry->width` and `cacheEntry->height` values during the actual memory copy operation. This allows a malicious RDP server to send crafted RDPGFX PDUs that cause the client to write beyond allocated heap memory. The attack requires the client to have RDPGFX (Remote Desktop Protocol Graphics Extension) enabled, which is commonly used for enhanced graphics performance in RDP sessions. Successful exploitation may result in denial of service through client crashes or potentially arbitrary code execution within the client process context.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade FreeRDP client to version 3.26.0 or later
  • Disable RDPGFX on FreeRDP clients if upgrade is not immediately feasible
  • Restrict RDP client connections to trusted, authenticated servers only
  • Monitor for anomalous RDPGFX PDU patterns in network traffic
  • Apply principle of least privilege for RDP client processes

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-p6r2-4hgm-m6ff. CVSS 3.1 score of 8.8 (HIGH) assigned. CWE-122 (Heap-based Buffer Overflow) identified. Fix version 3.26.0 explicitly stated in advisory. Attack vector requires network access to a malicious RDP server with RDPGFX enabled on the client.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44421 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44421

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44421 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44421

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.