dbcve.org
FreerdpApplication

CVE-2026-31806

CRITICAL · 9.8 CVSS v3.1 Published 2026-03-13
Fix available
A fix is available. Upgrade to 3.24.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Heap buffer overflow in FreeRDP's gdi_surface_bits() function when handling SURFACE_BITS_COMMAND messages with NSCodec. The server-provided bmp.width and bmp.height values are not validated against actual desktop dimensions, allowing a malicious RDP server to supply oversized values that cause overflow during bitmap decoding and memory operations, with attacker-controlled pixel data enabling heap memory overwrite.

MitigationUpgrade FreeRDP to version 3.4.0 or later. Since this is a client-side vulnerability, ensure connections only to trusted and verified RDP servers.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
FreerdpApplication
Affected:< 3.24.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify FreeRDP client version
    Run 'freerdp-version' or check package manager for installed freerdp package version
    Affected if Version is below 3.24.0
  2. Confirm FreeRDP client is in use
    Check if any FreeRDP client binaries (xfreerdp, wfreerdp, FreeRDP) are installed on the system using 'which xfreerdp' or 'which wfreerdp'
    Affected if FreeRDP client executables are present on the system
  3. Verify NSCodec is enabled or used
    Check FreeRDP configuration files or command-line defaults for NSCodec usage. Inspect /etc/freerdp/ or ~/.freerdp/ for codec settings, or review active connection strings for '/sec-nsc' flag
    Affected if NSCodec is enabled or negotiated in connections (NSCodec is the vulnerable code path)
  4. Check for connections to untrusted RDP servers
    Review connection logs, known_hosts, or audit logs for RDP sessions to servers that are not internally controlled or verified
    Affected if Connections are made to untrusted or potentially malicious RDP servers

User is affected if running FreeRDP client version below 3.24.0 and either uses NSCodec or connects to untrusted RDP servers, as the vulnerability is triggered by a malicious server sending oversized bitmap dimensions.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 3.24.0 or later
Fixed in 3.24.0
Vendor patch github.com →
Interim mitigation

Upgrade FreeRDP to version 3.4.0 or later. Since this is a client-side vulnerability, ensure connections only to trusted and verified RDP servers.

Recommended fix High confidence

FreeRDP 3.24.0

  1. Identify the current FreeRDP version installed (e.g., dpkg -l freerdp or rpm -qi freerdp)
  2. Upgrade FreeRDP to version 3.24.0 or later using the appropriate package manager or build from source
  3. For Debian/Ubuntu: apt-get update && apt-get install freerdp (or apt-get upgrade freerdp)
  4. For RHEL/CentOS: yum update freerdp
  5. For source compilation: Clone https://github.com/FreeRDP/FreeRDP, checkout version 3.24.0 or later, and build according to README instructions
  6. Verify the installed version matches 3.24.0 or higher using freerdp-version or the relevant package query command

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Freerdp Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing4.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,080
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-31806 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-31806 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data