FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit… (CVE-2026-109251)

The vulnerability in FreeRDP before version 3.32.0 involves improper handling of the MS-RDPEGT geometry origin supplied by the server. Specifically, the signed geometry origin is stored unchecked in an unsigned video surface coordinate, causing the blit clamp in the function gdiVideoShowSurface() to wrap due to 32-bit arithmetic and be skipped. This allows a malicious RDP server to send a negative topLevelLeft value to clients using the /video feature, resulting in an out-of-bounds write of decoded H.264 picture data or a client crash (abort).

This vulnerability can cause a denial of service (client abort) or potentially memory corruption due to an out-of-bounds write of video data. There is no indication of confidentiality or integrity impact. The CVSS score is 5.3 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, and no confidentiality or integrity impact but high impact on availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted RDP servers with the /video option enabled.