CVE-2026-44421 FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass

High 8.8 Published 29 May 2026 Updated 27 Jul 2026

A malicious RDP server can trigger a heap-buffer-overflow in FreeRDP clients with RDPGFX enabled, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-44421?

CVE-2026-44421 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 29 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2026-44421?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-44421?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-44421 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44421 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-44421, UBUNTU-CVE-2026-44421.