CVE-2026-31806

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0

Description FreeRDP is an implementation of the Remote Desktop Protocol. The gdi surface bits() function handles SURFACE BITS COMMAND messages from the RDP server. When using NSCodec, the bmp.width and bmp.height values are not validated against desktop dimensions. A malicious RDP server can send crafted bmp.width and bmp.height values exceeding the expected surface size. This can lead to a heap buffer overflow because these values are used during bitmap decoding and memory operations without proper bounds checking. An attacker controlling the pixel data can potentially overwrite adjacent heap memory.

Recommendations Versions prior to 3.24.0 should be updated to version 3.24.0 or later.