CVE-2026-31806

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The gdi_surface_bits() function, which processes SURFACE_BITS_COMMAND messages, does not properly validate image dimensions (bmp.width and bmp.height) provided by a malicious RDP server. This can lead to a heap buffer overflow during bitmap decoding and memory operations. A remote attacker could exploit this to overwrite adjacent memory, potentially resulting in arbitrary code execution.

For this vulnerability to be exploited, a susceptible system must connect to a malicious server. For that reason, Red Hat recommends that you only use FreeRDP to connect to trusted servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.