CVE-2026-85090

A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A remote attacker, acting as a malicious Remote Desktop Protocol (RDP) server, can exploit this by sending a specially crafted RFX_AVC444_BITMAP_STREAM with specific frame geometry. This can lead to an out-of-bounds memory read, potentially disclosing sensitive heap data to the client or causing a client crash, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.