CVE-2026-109251

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.0

Description The software fails to check the server-supplied signed MS-RDPEGT geometry origin, storing it in an unsigned video surface coordinate. This causes the blit clamp in the gdiVideoShowSurface() function to wrap in 32-bit arithmetic and be skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting via the /video endpoint, leading to a client abort or an out-of-bounds write of decoded H.264 picture data.

Recommendations Update to version 3.32.0 or later.