CVE-2026-109946

MEDIUMCVSS 6.5

Description

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.

Timeline

Published:October 13th, 2026 2:17 PM

Last modified:October 14th, 2026 8:10 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-617

References & Reports

Advisories, patches, and third-party reports

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrv
https://www.vulncheck.com/advisories/freerdp-3.11.0-before-3.32.0-reachable-assertion-via-avc444-odd-region-width

Source: NIST NVD · Data may lag official sources by up to one minute