CVE-2026-67290

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send specially crafted media data to a connected client. This malformed data can trigger a heap out-of-bounds read vulnerability within the TSMF FFmpeg decoder, leading to the client application crashing. This can result in a denial of service for the client.

This vulnerability in FreeRDP is rated as Important. A FreeRDP client connecting to a malicious or untrusted RDP server can be subjected to a denial of service. The flaw stems from a heap out-of-bounds read within the TSMF FFmpeg decoder when processing malformed media data, leading to client application crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Terminal Services Multimedia Redirection (TSMF) feature when connecting to untrusted RDP servers. This prevents the vulnerable media processing from being engaged.

For xfreerdp clients, use the /disable-tsmf or /tsmf:off command-line option:

xfreerdp /disable-tsmf <server_address>

Disabling TSMF will prevent multimedia content from being redirected during the RDP session.