Answer in brief
CVE-2026-111382 records a High severity (CVSS 8.7) vulnerability in FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine. The current sources do not mark it as known exploited. The current feed maps FreeRDP/FreeRDP (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps FreeRDP/FreeRDP (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| FreeRDP/FreeRDPgeneric | >=0 <3.32.0 | 3.32.0 |
Published upstream
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.
Quoted source text, attributed separately from HOL analysis.