CVE-2026-44421: FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass

Synopsis

This is a heap buffer overflow in FreeRDP's RDPGFX graphics pipeline, specifically in gdi_CacheToSurface, where a destination rectangle is validated after being clamped to UINT16_MAX while the actual copy uses the original unclamped cache entry width and height. A malicious RDP server can reach the bug over the network when a client connects with RDPGFX enabled and the user accepts the connection, triggering a large out-of-bounds heap write that can crash the client or lead to code execution. Although the description names 3.26.0 as the fix, no fix version was tagged in the published advisory record, so HarborGuard tracks the advisory for patched-image availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must get the victim's FreeRDP client to connect to an attacker-controlled RDP server over the network.

• AuthenticationNot required

  No credentials on the client side are needed; the malicious server simply responds to an incoming RDP session.

• Victim interactionRequired

  A user must initiate or accept an RDP connection to the attacker's server, typically via a malicious link, shortcut, or social-engineered hostname.

• Attack complexityDetail

  Attack complexity is low: the malformed RDPGFX PDU triggers the overflow reliably whenever the client has RDPGFX enabled.

Blast Radius

• Writes attacker-controlled data well past a heap allocation in the FreeRDP client process, corrupting adjacent heap structures.
• Crashes the RDP client, terminating the user's remote session and any in-progress work.
• Can be developed into remote code execution in the client process, giving the attacker the privileges of the user running the RDP client.
• Compromises the confidentiality of anything the client process can read, including credentials, clipboard contents, and mapped drive data passed over the RDP session.