CVE-2026-85090— FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP 3.31.0 之前的版本存在一个堆越界读取漏洞，该漏洞位于 函数中，发生在处理 AVC444 色度平面重建的过程中。恶意 RDP 服务器可以通过构造具有特定帧几何尺寸的 ，触发对已分配亮度（luma）平面之外的越界内存读取。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85090
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85090
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85090
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85090 (1)
Vendor Advisories for CVE-2026-85090 (2)
-
-
🔗 FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 | Advisories | VulnCheck third-party-advisory
Vendor Pages for CVE-2026-85090 (2)
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-85089
FreeRDP before 3.31.0 Information Disclosure via uninitializ -
CVE-2026-63633
FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp -
CVE-2026-63652
FreeRDP: Double-free of `client_formats` in the rdpsnd serve -
CVE-2026-63117
FreeRDP: Denial of service through ADPCM frame size calculat -
CVE-2026-55192
FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion d
Same vendor: FreeRDP
-
CVE-2026-85089
FreeRDP before 3.31.0 Information Disclosure via uninitializ -
CVE-2026-63633
FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp -
CVE-2026-63652
FreeRDP: Double-free of `client_formats` in the rdpsnd serve -
CVE-2026-63117
FreeRDP: Denial of service through ADPCM frame size calculat -
CVE-2026-55192
FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion d
Same weakness: CWE-125
-
CVE-2026-84484
ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv -
CVE-2026-84270
Gvfs: mtp: out-of-bounds read in do_read() -
CVE-2026-82618
Systerel S2OPC String Array Range Writing sopc_builtintypes. -
CVE-2026-82608
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds -
CVE-2026-82330
Gimp: heap out-of-bounds read in pvr vq (compressed) decoder
V. Comments for CVE-2026-85090
No comments yet