CVE-2026-44421

A heap-buffer-overflow vulnerability exists in FreeRDP when handling Remote Desktop Protocol Graphics (RDPGFX). A malicious or compromised RDP server can exploit this flaw by sending specially crafted graphics packets to a connected client, potentially crashing the client application (Denial of Service) or executing arbitrary code on the user's machine.

An Important-rated heap-buffer-overflow vulnerability exists in FreeRDP clients using the RDPGFX feature. If a user connects to a malicious RDP server, the server can trigger this flaw to cause a client crash (Denial of Service) or execute arbitrary code on the client machine. The risk is limited to users connecting to untrusted hosts with RDPGFX enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the RDPGFX graphics acceleration feature in your FreeRDP client configuration. Additionally, avoid using FreeRDP to connect to untrusted or unknown external servers. This may cause a temporary disruption in service for your users.