CVE-2026-85090

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An issue exists in the general ChromaV1ToYUV444() function during AVC444 chroma plane reconstruction. A malicious RDP server can send a specially crafted RFX AVC444 BITMAP STREAM with specific frame geometry to trigger a heap out-of-bounds read, which occurs when the system reads memory past the allocated luma plane.

Recommendations Update FreeRDP to version 3.31.0 or later.