CVE-2026-109946

FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width

State: Published
Severity: 7.1 High
Published: Oct 13, 2026
Updated: Oct 18, 2026
Reserved: Oct 13, 2026

Description

FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-617 Reachable Assertion

Affected Products

Product	Versions
FreeRDPFreeRDP	3.11.0 to before 3.32.0Affected 3.32.0Not affected

References

GitHub Security Advisory (GHSA-97pf-pwp3-2wrv)vendor-advisory
VulnCheck Advisory: FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Widththird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.