CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
CVE-2026-109946- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2026-98711
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
EUVD-2026-98711- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vqwq-3725-m59m
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even...
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
GHSA-vqwq-3725-m59m- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
CVE-2026-109946- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
CVE-2026-109946- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
DEBIAN-CVE-2026-109946- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width.
- Record
UBUNTU-CVE-2026-109946- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freerdp2Debian:12 |
All versions, plus listed versions 2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2 Show 8 moreShow less2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1 |
None known |
freerdp3Debian:13 |
All versions, plus listed versions 3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1 Show 45 moreShow less3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-13.32.1+dfsg-13.32.1+dfsg-1~bpo13+13.32.2+dfsg-1 |
None known |
freerdp3Debian:14 |
before 3.32.0+dfsg-1, plus listed versions 3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1 Show 38 moreShow less3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+1 |
3.32.0+dfsg-1 |
freerdpUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4 |
None known |
freerdp2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6 Show 14 moreShow less2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6 |
None known |
freerdpUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2 |
None known |
freerdp2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1 Show 12 moreShow less2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4 |
None known |
freerdp2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1 Show 18 moreShow less2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11 |
None known |
freerdp3Ubuntu:24.04:LTS |
before 3.32.0+dfsg-0ubuntu0.24.04.1, plus listed versions 3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1 Show 8 moreShow less3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.63.30.0+dfsg-0ubuntu0.24.04.13.30.0+dfsg-0ubuntu0.24.04.23.31.0+dfsg-0ubuntu0.24.04.1 |
3.32.0+dfsg-0ubuntu0.24.04.1 |
freerdp2Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1 Show 7 moreShow less2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6 |
None known |
freerdp3Ubuntu:26.04:LTS |
before 3.32.0+dfsg-0ubuntu0.26.04.1, plus listed versions 3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1 Show 9 moreShow less3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.13.30.0+dfsg-0ubuntu0.26.04.13.30.0+dfsg-0ubuntu0.26.04.23.31.0+dfsg-0ubuntu0.26.04.1 |
3.32.0+dfsg-0ubuntu0.26.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-109946 is a high vulnerability (CVSS 7.1) in Freerdp, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in freerdp3 3.32.0+dfsg-1.
References
github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97pf-pwp3-2wrv
vulncheck.com/advisories/freerdp-3.11.0-before-3.32.0-reachable-assertion-via-avc444-odd-region-width
nvd.nist.gov/vuln/detail/CVE-2026-109946
security-tracker.debian.org/tracker/CVE-2026-109946
ubuntu.com/security/CVE-2026-109946
cve.org/CVERecord?id=CVE-2026-109946