CVE-2026-121950

FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi CreateSurface when handling an RDPGFX CREATE SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service.