CVE-2026-85090: Freerdp

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.

Affected products

• Freerdp Freerdp: before 3.31.0 (fixed in 3.31.0)

Published 2026-09-03. Last modified 2026-09-09.