CVE-2026-111382: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111382 is a client-side heap out-of-bounds write vulnerability in FreeRDP affecting the general_LumaToYUV444 and general_ChromaV2ToYUV444 functions. It allows a malicious or compromised RDP server to corrupt heap memory on a connecting client by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially leading to arbitrary code execution. All FreeRDP versions up to and including 3.31.1 are affected; version 3.32.0 contains the fix. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, FreeRDP Advisory). The vulnerability was published on October 16, 2026, and is tracked under GHSA-f4pf-pgp4-f2r3 and GHSA-9992-vx98-33c7.

The root cause is an out-of-bounds write (CWE-787) in the AVC444/AVC444v2 YUV444 chroma-combine path of FreeRDP's video decoding pipeline. The U/V plane buffers are allocated tightly in avc444_ensure_buffer with padDstHeight == surface->height and zero slack, since the surface height is already 16-aligned. When a malicious server sends a region rect with an odd height whose bottom equals surface->height, the ceiling half-height calculation (nHeight+1)/2 causes the final loop iteration in general_LumaToYUV444 (B2/B3 loop) and general_ChromaV2ToYUV444 (B6-B9 loop) to write one full row past the end of the allocated U and V planes. Critically, the pool_decode_rect combine path does not apply clamp() to region rects (unlike the YUV420→RGB path), and existing validation checks (is_rect_valid, areRectsValid, check_rect) only enforce bottom <= height rather than bottom < height, allowing the malicious geometry to pass undetected. All three primitive backends (general, SSE4.1, NEON) are affected (FreeRDP Advisory).

Successful exploitation results in heap memory corruption on the FreeRDP client, with high impact to confidentiality, integrity, and availability. An attacker controlling a malicious RDP server can write up to approximately nWidth server-controlled bytes past each of the U and V heap plane allocations, providing a classic heap corruption primitive that can be leveraged for arbitrary code execution on the client system with the privileges of the user running FreeRDP. This vulnerability is strictly more severe than the related OOB read CVE-2026-85090, as the tightly-allocated FreeRDP destination buffer has zero slack on every H.264 backend (MediaFoundation, mediacodec, ffmpeg, openh264) (FreeRDP Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction — a victim must connect to an attacker-controlled RDP server — but no privileges are required on the attacker's side, lowering the barrier for a social engineering or adversary-in-the-middle attack scenario.

1. Set up a malicious RDP server: The attacker deploys a rogue RDP server (e.g., using a modified FreeRDP server build or a custom RDPGFX implementation) capable of sending crafted RDPGFX wire-to-surface messages.
2. Lure the victim: The attacker tricks a user running a vulnerable FreeRDP client (version ≤ 3.31.1) into connecting to the malicious server via phishing, a malicious link, or a man-in-the-middle attack on an existing RDP session.
3. Create a trigger surface: Upon client connection, the server sends a CreateSurface command with dimensions such as width=64, height=16 — a 16-aligned height that results in a tightly-allocated U/V plane with zero slack.
4. Send crafted AVC444/AVC444v2 frame: The server sends a RDPGFX_WIRE_TO_SURFACE_1 message using AVC444 (targeting general_LumaToYUV444) or AVC444v2 (targeting general_ChromaV2ToYUV444) with a region rect such as {left:0, top:1, right:64, bottom:16}, yielding nHeight=15 (odd) and roi->bottom=16=surface->height.
5. Trigger OOB write: The client's YUV444 combine path processes the frame; the ceiling half-height (15+1)/2=8 causes the last loop iteration (y=7) to write to absolute row 16, which is exactly at the end of the allocation — one full row past the U and V plane buffers.
6. Achieve heap corruption and code execution: The attacker-controlled decoded U/V bytes overwrite adjacent heap metadata or objects, enabling further exploitation techniques (e.g., heap grooming, use-after-free chaining) to achieve arbitrary code execution on the client with the user's privileges (FreeRDP Advisory).

• Network: Outbound RDP connections (TCP port 3389 or custom ports) from client systems to unknown or untrusted external IP addresses; RDPGFX traffic containing WIRE_TO_SURFACE_1 messages with AVC444/AVC444v2 codec identifiers and anomalous region rect geometries (odd-height rects with bottom == surface height).
• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) spawning unexpected child processes (e.g., shells, curl, wget) or exhibiting abnormal memory usage or crashes (segmentation faults) shortly after connecting to an RDP server.
• Logs: Application crash logs or core dumps from the FreeRDP process referencing general_LumaToYUV444, general_ChromaV2ToYUV444, or pool_decode_rect; heap corruption error messages from memory allocators (e.g., glibc malloc corruption detected).
• File System: Unexpected files written to disk by the FreeRDP process or its children; new persistence mechanisms (cron jobs, systemd units, registry run keys on Windows) created under the user account running FreeRDP.

The primary remediation is to upgrade FreeRDP to version 3.32.0 or later, which adds the missing row-bounds guard (row < nHeight) to the B2/B3 loop of general_LumaToYUV444 and the B6-B9 loop of general_ChromaV2ToYUV444 across all backends, or alternatively applies clamp() to region rects on the 444-combine path (FreeRDP Advisory). As a workaround, users should avoid connecting to untrusted or unknown RDP servers and restrict RDP client usage to verified, trusted internal servers only. Organizations should also monitor for vendor-specific package updates (e.g., Red Hat, Debian, Ubuntu) that bundle the patched FreeRDP version (Red Hat Bugzilla).