CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
A malicious RDP server can crash the FreeRDP client by sending an AVC444 region with an odd width, causing an assertion failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109946?
CVE-2026-109946 is a high-severity denial of service vulnerability in Freerdp Freerdp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
Weakness: CWE-617
Which versions are affected by CVE-2026-109946?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-109946?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-109946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109946 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-109946, GHSA-97pf-pwp3-2wrv, GHSA-vqwq-3725-m59m, UBUNTU-CVE-2026-109946.