CVE-2026-31806 is a critical heap buffer overflow (CVSS 9.8) in FreeRDP before 3.24.0. A malicious RDP server can send bitmap sizes that are not checked, overflowing memory in the client. Update FreeRDP to 3.24.0 or install your distribution's patched package.
What's affected
FreeRDP versions before 3.24.0 are affected. The fix is in 3.24.0.
The vulnerable code is the gdi_surface_bits function, when it handles SURFACE_BITS_COMMAND messages that use the NSCodec codec. The risk is to FreeRDP as a client connecting to a server, not to a FreeRDP server.
The references include Red Hat errata, so distributions ship backported fixes. Check your vendor's advisory for the package version that carries the patch.
How to check if you're exposed
Print the client version:
xfreerdp /version
On some systems the binary is named xfreerdp3 or wlfreerdp, and tools such as Remmina, GNOME Connections or other remote desktop apps may embed the library. List the library packages instead:
rpm -qa | grep -i freerdp
dpkg -l | grep -i freerdp
Compare the result with 3.24.0 or with your distribution's fixed package from its security notice.
What to do now
- Update FreeRDP to 3.24.0 or the distribution package that backports the fix.
- Update applications that bundle FreeRDP, and rebuild container images that include it.
- Connect only to RDP servers you trust until clients are patched.
- Add the library to your software inventory so you can find every client that uses it.
Why it matters
The weaknesses are CWE-122, heap based buffer overflow, and CWE-131, incorrect calculation of buffer size. The server supplies the bitmap width and height, and the client used them for decoding and memory operations without comparing them with the actual desktop size.
Because the attacker also controls the pixel data, the record says the overflow may be exploitable to overwrite adjacent heap memory. The direction of attack is unusual. The victim is the one who connects. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it affect a FreeRDP based server?
The record describes the client side function that processes messages from the server. A malicious server is the attacker.
Can I check which apps embed FreeRDP?
A dependency scan of your images and projects lists it. The free scanner at https://gold.safeguard.sh/scan can check a project.
Sources
- FreeRDP security advisory GHSA-rrqm-46rj-cmx2
- Red Hat erratum RHSA-2026:10076
- NVD record for CVE-2026-31806
Last reviewed: 19 October 2026.
