CVE-2026-31806
published 2026-03-13CVE-2026-31806: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent…
PriorityP259critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.67%
51.6th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| freerdp | freerdp | < 3.24.0 | 3.24.0 |
| ubuntu | freerdp3 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv9.3CRITICAL
vendor_debian9.3CRITICAL
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-31806: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-03-13·CVSS 9.3
CVE-2026-31806 [CRITICAL] CVE-2026-31806: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-07-20
CVE-2026-33995 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
vendor_redhat·2026-03-13·CVSS 9.3
CVE-2026-31806 [CRITICAL] CWE-131 freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, th
Debian
CVE-2026-31806: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
vendor_debian·2026·CVSS 9.3
CVE-2026-31806 [CRITICAL] CVE-2026-31806: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [epel-all]
bugzilla·2026-03-13·CVSS 9.8
CVE-2026-31806 [CRITICAL] CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [epel-all]
CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-EPEL-2026-1c4570b861 (freerdp2-2.11.7-7.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1c4570b861
---
FEDORA-EPEL-2026-aa30a19f4c has been pushed to the Fedora EPEL 10.3 testing repository.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-aa30a19f4c
See also https://fedoraproject.org/wiki/QA:Upd
Bugzilla
CVE-2026-31806 freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
bugzilla·2026-03-13·CVSS 9.3
CVE-2026-31806 [CRITICAL] CVE-2026-31806 freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
CVE-2026-31806 freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by
Bugzilla
CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [fedora-all]
bugzilla·2026-03-13·CVSS 9.8
CVE-2026-31806 [CRITICAL] CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [fedora-all]
CVE-2026-31806 freerdp2: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Wiz
CVE-2026-31806 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-31806 [CRITICAL] CVE-2026-31806 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31806 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to ove
https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2bhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2https://access.redhat.com/errata/RHSA-2026:10076https://access.redhat.com/errata/RHSA-2026:10734https://access.redhat.com/errata/RHSA-2026:10735https://access.redhat.com/errata/RHSA-2026:10951https://access.redhat.com/errata/RHSA-2026:11323https://access.redhat.com/errata/RHSA-2026:19033https://access.redhat.com/errata/RHSA-2026:6340https://access.redhat.com/errata/RHSA-2026:6727https://access.redhat.com/errata/RHSA-2026:6743https://access.redhat.com/errata/RHSA-2026:6799https://access.redhat.com/errata/RHSA-2026:6918https://access.redhat.com/errata/RHSA-2026:6958https://access.redhat.com/errata/RHSA-2026:9640https://access.redhat.com/errata/RHSA-2026:9641https://access.redhat.com/security/cve/CVE-2026-31806https://bugzilla.redhat.com/show_bug.cgi?id=2447376https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31806.json
2026-03-13
Published