Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-109946FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
Medium 6.5
In plain English
A medium-severity security flaw in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-109946 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-109946 |
| Debian:14 | freerdp3 | 3.32.0+dfsg-1 | DEBIAN-CVE-2026-109946 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-109946 |
| Ubuntu:24.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-109946 |
| Ubuntu:26.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-109946 |
Affected products (as reported)
Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-97pf-pwp3-2wrv) vendor-advisory
- VulnCheck Advisory: FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width third-party-advisory