CVE-2026-29774

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates. In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420yuvtorgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRETOSURFACEPDU1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420processworkcallback calls avc420yuvto_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29774.json"
}

References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type

GIT

Repo

https://github.com/freerdp/freerdp

Events

Introduced

Fixed

b00402d3258402c868224b6ffed04182cbed78d9

Fixed

6482b7a92fff3959582cef052d1967ad6bde3738

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.24.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.0-beta1

1.0-beta2

1.0-beta4

1.0-beta5

1.0.0

1.0.1

1.1.0-beta+2013071101

1.1.0-beta1

1.1.0-beta1+android2

1.1.0-beta1+android3

1.1.0-beta1+android4

1.1.0-beta1+android5

1.1.0-beta1+ios1

1.1.0-beta1+ios2

1.1.0-beta1+ios3

1.1.0-beta1+ios4

1.2.0-beta1+android7

1.2.0-beta1+android9

2.*

2.0.0

2.0.0-beta1+android10

2.0.0-beta1+android11

2.0.0-rc0

2.0.0-rc1

2.0.0-rc2

2.0.0-rc3

2.0.0-rc4

3.*

3.0.0

3.0.0-beta1

3.0.0-beta2

3.0.0-beta3

3.0.0-beta4

3.0.0-rc0

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.5.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-29774.json"

vanir_signatures_modified

"2026-08-12T15:29:33Z"

vanir_signatures

[
    {
        "digest": {
            "line_hashes": [
                "82090971309097896947798054191747200388",
                "151143178055215798074371252896108113673",
                "302978422804700552857034052314802093612",
                "216747868806864560811303568812071239055",
                "131797079156359813540097924849051669263",
                "314262905048842231731461347756714594708",
                "259609487899902251808540096996038091177",
                "246426937750903559676796787683443706696",
                "222625105718741948076116464436008023416"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/freerdp/freerdp/commit/6482b7a92fff3959582cef052d1967ad6bde3738",
        "target": {
            "file": "libfreerdp/codec/h264.c"
        },
        "deprecated": false,
        "id": "CVE-2026-29774-62fda26c",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "digest": {
            "function_hash": "199902800736896388494859393838405677411",
            "length": 642.0
        },
        "source": "https://github.com/freerdp/freerdp/commit/6482b7a92fff3959582cef052d1967ad6bde3738",
        "target": {
            "file": "libfreerdp/codec/h264.c",
            "function": "avc420_decompress"
        },
        "deprecated": false,
        "id": "CVE-2026-29774-6f1b812b",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "digest": {
            "function_hash": "196197554946584439630228823138909942126",
            "length": 1578.0
        },
        "source": "https://github.com/freerdp/freerdp/commit/6482b7a92fff3959582cef052d1967ad6bde3738",
        "target": {
            "file": "libfreerdp/codec/h264.c",
            "function": "avc444_decompress"
        },
        "deprecated": false,
        "id": "CVE-2026-29774-b5b2f500",
        "signature_version": "v1",
        "signature_type": "Function"
    }
]