FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:5936 https://access.redhat.com/errata/RHSA-2026:5936
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:5939 https://access.redhat.com/errata/RHSA-2026:5939
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:6005 https://access.redhat.com/errata/RHSA-2026:6005
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:6004 https://access.redhat.com/errata/RHSA-2026:6004
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:6384 https://access.redhat.com/errata/RHSA-2026:6384
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:6385 https://access.redhat.com/errata/RHSA-2026:6385
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:6395 https://access.redhat.com/errata/RHSA-2026:6395
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:6396 https://access.redhat.com/errata/RHSA-2026:6396
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:6616 https://access.redhat.com/errata/RHSA-2026:6616
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:6665 https://access.redhat.com/errata/RHSA-2026:6665
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2026:6712 https://access.redhat.com/errata/RHSA-2026:6712
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:6764 https://access.redhat.com/errata/RHSA-2026:6764
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:7292 https://access.redhat.com/errata/RHSA-2026:7292
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:19033 https://access.redhat.com/errata/RHSA-2026:19033