CVE-2026-31806

CRITICAL

CVSS v3.1: 9.8 · EPSS: 0.0053 (40.9 percentile)

NetworkNo privilegesNo user interactionHeap OverflowVendor advisory ref

Source data as of:

At a glance

Severity
CRITICAL
CVSS
9.8 v3.1 · NVD
EPSS
0.0053 (40.9 percentile) · FIRST.org
CISA KEV
No
Type
Heap Overflow · NVD CWE
Attack conditions (CVSS vector)
NetworkNo privilegesNo user interaction · Source: NVD Vector
Affected vendors
freerdp
Published
2026-03-13 · Modified: 2026-06-30
References
Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 9.8 / 10 CRITICAL Source: NVD
CVSS v4.0 9.3 / 10 CRITICAL Source: NVD
EPSS 0.0053 40.9 percentile Source: FIRST.org
CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.

Record details

CVE ID
CVE-2026-31806
CVSS (v3.1)
9.8 (CRITICAL)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore
3.9
Impact subscore
5.9
EPSS
0.0053 (40.9 percentile) — 2026-06-30
CISA KEV
No
Weakness (CWE)
CWE-122, CWE-131
Affected vendors
freerdp
Affected configurations (CPE)
1
Published
2026-03-13
Modified
2026-06-30
Status
Modified

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Related records

Other records sharing a factual facet, for cross-reference. A descriptive neighbourhood — ordering does not imply priority and is not a recommendation.

Same affected vendor

CVE-2026-22853 CRITICAL CVSS 9.8 CVE-2026-23530 CRITICAL CVSS 9.8 CVE-2026-23531 CRITICAL CVSS 9.8 CVE-2026-23532 CRITICAL CVSS 9.8

Same weakness type (CWE)

CVE-2006-10003 CRITICAL CVSS 9.8 CVE-2024-12084 CRITICAL CVSS 9.8 CVE-2025-67268 CRITICAL CVSS 9.8 CVE-2026-23530 CRITICAL CVSS 9.8

Published the same year

CVE-2026-0881 CRITICAL CVSS 10.0 CVE-2026-2760 CRITICAL CVSS 10.0 CVE-2026-2761 CRITICAL CVSS 10.0 CVE-2026-2768 CRITICAL CVSS 10.0
← Back to all records