CVE-2026-111382

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in arbitrary code execution or a denial of service (DoS) on the client system.

This vulnerability is rated as an Important severity because successful exploitation could allow a remote server to execute arbitrary code within the privileges of the connecting client user, rather than affecting the underlying system with elevated privileges. Within Red Hat Enterprise Linux, FreeRDP functions as a client application and library for Remote Desktop Protocol sessions. The flaw is not directly exploitable over the network unless a local user or automated service actively initiates a connection to an untrusted or malicious endpoint. Environments that do not establish outbound RDP connections are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.