CVE-2026-31806
Published: 13 March 2026
Summary
CVE-2026-31806 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freerdp Freerdp. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 40.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31806 is a heap buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.24.0. The flaw occurs in the gdi_surface_bits() function when processing SURFACE_BITS_COMMAND messages sent by the RDP server using NSCodec. The bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions, enabling a malicious server to supply crafted values that exceed the expected surface size. This leads to improper bounds checking during bitmap decoding and memory operations, classified under CWE-122 with a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker controlling a malicious RDP server can exploit this vulnerability when a victim client connects to it. By sending oversized bmp.width and bmp.height values along with controlled pixel data, the attacker triggers a heap buffer overflow, allowing overwrite of adjacent heap memory. This may enable arbitrary code execution or other severe impacts, requiring no authentication or user interaction from the victim.
The vulnerability is addressed in FreeRDP version 3.24.0. Mitigation involves updating to 3.24.0 or later. Details are available in the fix commit at https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b and the GitHub security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12060
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server…
more
are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in FreeRDP client (gdi_surface_bits) triggered by malicious RDP server sending crafted SURFACE_BITS_COMMAND/NSCodec data, directly enabling remote code execution on victim client with no auth/UI required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly mitigating this CVE by updating FreeRDP to version 3.24.0 where bounds checking for bmp.width and bmp.height is fixed.
SI-10 mandates validation of information inputs like bmp.width and bmp.height against expected surface dimensions, preventing the heap buffer overflow from unvalidated server-provided values.
SI-16 provides memory protections such as non-executable heap and ASLR to mitigate exploitation of the heap buffer overflow even if input validation fails.