CVE-2026-31806Disclosure(freerdp / freerdp)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch freerdp freerdp systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

freerdp CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2

Other references

Weakness type (CWE)

CWE-122CWE-131

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

freerdp

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-03-13); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

freerdp

Products

freerdp

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-13	4	Disclosure3General1
2026-04-01	1	Patch1

Full discourse5 posts

0day Signal@0dayPublishing209d
Disclosure
🚨 CVE-2026-31806: FreeRDP has a Heap Buffer Overfl... Malicious RDP servers can trigger heap corruption by sending oversized bitmap dimensions that bypass NSCodec bounds che... https://zerodaysignal.com/vulnerability/CVE-2026-31806 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a new heap buffer overflow vulnerability in FreeRDP—triggered by oversized bitmap dimensions—but provides no PoC, exploit code, patch details, or evidence of active exploitation.
0100079
144 followersView on X
ThreatCluster@threatcluster191d
Patch
BREAKING: SUSE pushes FreeRDP security update fixing 6 critical flaws including CVE-2026-31806 and CVE-2026-31883 that enable remote code execution across multiple Linux architectures. https://threatcluster.io/cluster/critical-vulnerabilities-in-freerdp-addressed-by-suse-securi-2dc5453b
Post summary
SUSE releases a security update addressing six critical RCE flaws in FreeRDP on Linux.
0000039
128 followersView on X
Infoflowcloud@infoflowcloud209d
Disclosure
🚨*CVE* CVE-2026-31806 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the… https://www.cve.org/CVERecord?id=CVE-2026-31806 ----- Traducción: CVE-2026-31806 Fre… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-31806 affecting FreeRDP prior to version 3.24.0, noting a vulnerability in SURFACE_BITS_COMMAND handling, but provides no PoC, exploit, or patch details.
0000027
57 followersView on X
CVE@CVEnew209d
General
CVE-2026-31806 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the… https://www.cve.org/CVERecord?id=CVE-2026-31806
Post summary
The text provides a concise technical description of CVE‑2026‑31806, noting that before version 3.24.0 the gdi_surface_bits() function improperly handles SURFACE_BITS_COMMAND messages.
00000209
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash209d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-31806 - FreeRDP Remote Desktop Protocol Heap Buffer Overflow Intel Report: https://ift.tt/Sl0jBgW
Post summary
The alert announces CVE-2026-31806 as a heap buffer overflow in FreeRDP, providing a link to an intel report but no evidence of PoC, exploit, or active use.
0000030
340 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	freerdp	freerdp	-	-	-

Explore more

Back to dashboard freerdp CVEs freerdp vulnerabilities

What researchers are saying

CVE-2026-31806

ThreatCluster[verified]@threatclusterPatch

SUSE releases a security update addressing six critical RCE flaws in FreeRDP on Linux.

0day Signal@0dayPublishingDisclosure

The tweet announces a new heap buffer overflow vulnerability in FreeRDP—triggered by oversized bitmap dimensions—but provides no PoC, exploit code, patch details, or evidence of active exploitation.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2026-31806 affecting FreeRDP prior to version 3.24.0, noting a vulnerability in SURFACE_BITS_COMMAND handling, but provides no PoC, exploit, or patch details.

CVE@CVEnewGeneral

The text provides a concise technical description of CVE‑2026‑31806, noting that before version 3.24.0 the gdi_surface_bits() function improperly handles SURFACE_BITS_COMMAND messages.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE-2026-31806 as a heap buffer overflow in FreeRDP, providing a link to an intel report but no evidence of PoC, exploit, or active use.