CVE-2026-85090 Threat Intelligence Report

Executive Summary

CVE-2026-85090 is a heap out-of-bounds read vulnerability in FreeRDP, an open-source Remote Desktop Protocol (RDP) implementation, affecting all versions prior to 3.31.0. The flaw exists in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction, and a malicious RDP server can trigger memory read operations beyond the allocated luma plane boundaries by sending a crafted RFX_AVC444_BITMAP_STREAM with specific frame geometry. The vulnerability has a CVSS score of 5.4, requires user interaction, and can lead to information disclosure and potential denial of service; no patch or vendor confirmation is currently available.

Technical Analysis

FreeRDP is a client/server implementation of Microsoft's Remote Desktop Protocol predominantly used in Linux environments but also compiled for BSD, macOS, and Windows platforms. The vulnerability resides within the code path that handles AVC444-encoded bitmap streams, which represent a hybrid RemoteFX coding scheme combining H.264 (AVC) compression with legacy RemoteFX codec layers.

Vulnerability Mechanism

The AVC444 codec processing involves converting luma (Y) and chroma (U/V) planes back into YUV444 format from their respective YUV420 representations. The affected function, general_ChromaV1ToYUV444, performs chroma plane reconstruction during this conversion. A chromosome-up-sampling operation reads from the source luma plane buffer to interpolate or replicate chroma values into the destination YUV444 buffer.

The out-of-bounds read occurs when an RDP server advertises—within an RFX_AVC444_BITMAP_STREAM—frame geometry (dimensions such as width/height or the subsampling stride parameters) that results in the chroma conversion routine accessing memory addresses beyond the allocated bounds of the luma color plane. Specifically, the allocation for the luma plane assumes certain alignment or minimum dimensions based on the advertised header values; a mismatch between the actual allocated buffer size and the geometry-driven memory access pattern causes reads to walk past the heap allocation end.

Attack Surface

Within an RDP session, the RDP server pushes frame updates to the client. In an attack scenario, the adversary controls the RDP server endpoint and crafts the RFX_AVC444_BITMAP_STREAM such that malicious frame geometry triggers the chroma conversion routine to read OOB. The client will then process this stream only after a user has initiated an RDP connection to the malicious host (the UI:R component of the CVSS vector).

Impact is twofold: memory disclosure and potential denial of service. The disclosed data is returned at the application level possibly through subsequent decoding operations and can leak adjacent heap memory content in varying degrees depending on heap layout and allocation ordering. In a worst case, the OOB read addresses an unmapped memory region, crashing the client.

Note: specific function-level implementation details beyond general_ChromaV1ToYUV444 and RFX_AVC444_BITMAP_STREAM are not provided in the available data; this analysis is conducted at the class and mechanism level.

Exploitation Scenarios

Reconnaissance: An attacker identifies potential FreeRDP-based RDP clients by scanning for exposed endpoints, or targets users known to connect to untrusted RDP services. Since the attack is server-side, the luring of a FreeRDP client to connect to an attacker-controlled server can be carried out via social engineering, or by compromising existing infrastructure users trust.

Triggering: The malicious server, upon receiving the RDP connection and successfully completing the handshake, initiates RemoteFX channel establishment to enable AVC444 codec support. The server then sends a crafted RFX_AVC444_BITMAP_STREAM containing frame geometry coordinates specifically designed to force general_ChromaV1ToYUV444 into a chroma reconstruction cycle that reaches beyond the allocated luma plane heap buffer.

Payload Execution: No code execution is expected; the vulnerability class is a read-out-of-bounds. An adversary controls the frame attributes within the RFX stream to cause the affected routine to read as much adjacent heap memory as possible while still keeping the decoding pipeline alive, thus maximizing data leakage.

Post-Exploitation Impact: Data returned from the OOB reads may persist in subsequent on-screen frame content or error logs, depending on FreeRDP's error handling. The attacker could attempt to harvest credential material, TLS session data, or other sensitive information adjacent to the luma plane allocation. Alternatively, the attack can be used as a kill-switch to terminate the client process, producing a denial of service. No public PoC is available; the attack chain is inferred from the vulnerability description.

Impact Assessment

Confidentiality Impact (Partial): The attacker can leak adjacent heap contents—potentially sensitive—depending on attacker control over heap allocations prior to the OOB read. In the Desktop Client attack scenario, the attacker controls only the remote server, thus mitigating some possibility of precise heap grooming but making opportunistic reading of heap data possible.

Availability Impact (Low): Depending on memory layout, the OOB read might access unmapped addresses, triggering segmentation faults and crashing the client. A successful DoS is remotely initiated, requiring the unsuspecting user to connect.

Attack Complexity: Low — the crafted stream can be fabricated without interaction with the target beyond the initial connection being initiated. No post-authentication state is strictly required if codec negotiation allows early stage triggering.

Blast Radius: Any FreeRDP versions prior to 3.31.0 that support RemoteFX/AVC444. This includes many enterprise Linux thin clients, GPU-enabled VDI deployments, and embedded systems relying on FreeRDP for RDP connectivity.

Detection Guidance

The following detection rules target anomalous traffic patterns, suspicious server error message sequences, and client-side fault events reflective of CVE-2026-85090 exploitation. Note: rule-specific fields mentioned below reflect the best-effort detection parameterizations based on the RDP/RemoteFX protocol data definitions.

Sigma Rule

title: FreeRDP AVC444 Chroma OOB Read Attempt
id: 6f1a4d55-1930-4d2b-8b68-3de1df8524b7
status: experimental
description: Detects RDP client-side log messages indicating chroma reconstruction failure or out-of-bounds access in FreeRDP clients prior to 3.31.0
logsource:
    product: linux
    category: application
    definition: 'Requires FreeRDP client debug or warning level logging (e.g., with /log-level:WARN)'
detection:
    selection_chroma_error:
        - message: '*general_ChromaV1ToYUV444*'
        - message: '*chroma*out of bounds*'
        - message: '*OOB read*AVC444*'
    selection_geom_error:
        - message: '*RFX_AVC444_BITMAP_STREAM*'
        - message: '*frame geometry*invalid*'
    condition: selection_chroma_error OR selection_geom_error
level: high
falsepositives:
    - Corrupted RDP sessions where the server incorrectly sends malformed data due to interoperability issues
    - Debug versions of FreeRDP emitting routine names in Normal operation logging
fields:
    - message
    - source_process_name
tags:
    - attack.t1190
    - cve.2026.85090

YARA Rule

rule FreeRDP_AVC444_OOB_Chroma_Stream {
    meta:
        description = "Detect crafted RFX_AVC444_BITMAP_STREAM geometry triggering chroma OOB in FreeRDP < 3.31.0"
        author = "ValtersIT Cyber Analysis Team"
        date = "2026-02-15"
        cve = "CVE-2026-85090"
        severity = "high"
    strings:
        // RFX_AVC444_BITMAP_STREAM typically begins with a region header framing and
        // carries the value 0xCF (AVC444 magic variant) in early sub-header bytes.
        $avc_magic = { CF 01 00 00 } // bytes found in bitmap stream headers
        $avc_magic_alt = { CF 02 00 00 }
        // Match width/height values that can supply the malformed geometry. Since frame
        // geometry fields encode little-endian 16-bit dimensions, samples match extremes.
        $exp_geom = { FF FF 00 00 }  // Possible overflow-inducing dimensions
        // Log strings from client that captured error path
        $err_chroma = "general_ChromaV1ToYUV444" ascii
        $err_oob = "out of bounds" ascii nocase
    condition:
        (uint16(0) == 0xCF and #exp_geom > 0) or
        ($err_chroma and ($err_oob or filesize < 2MB))
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET 3389 <> $HOME_NET any (msg:"ET EXPLOIT FreeRDP AVC444 Chroma OOB Attempt CVE-2026-85090"; flow:established,to_client; content:"|cf 01 00 00|"; depth:8; content:"|ff ff|"; within:128; reference:cve,2026-85090; classtype:attempted-dos; sid:202685090; rev:1;)

Elastic Detection

{
  "description": "Detect FreeRDP client termination or error events related to AVC444 chroma buffer over-reads",
  "query": {
    "bool": {
      "should": [
        {"match_phrase": {"message": "general_ChromaV1ToYUV444"}},
        {"match_phrase": {"message": "out-of-bounds in chroma"}},
        {"match_phrase": {"process.name": "xfreerdp"}}
      ],
      "filter": [
        {"range": {"@timestamp": {"gte": "now-7d"}}},
        {"terms": {"event.code": ["113", "24", "11"]}} 
      ],
      "minimum_should_match": 2
    }
  }
}

Splunk SPL Query

index=linux sourcetype=freerdp_logs OR sourcetype=syslog
| where match(message, "(general_ChromaV1ToYUV444|chroma.*(out.?of.?bounds|OOB)|AVC444)") 
| search (process=xfreerdp OR process=wlfreerdp OR process=sfreerdp)
| table _time, host, user, process, message
| eval threat="CVE-2026-85090"
| stats count by host, process, threat

Wazuh OSSEC Rule

<group name="freerdp_rce,">
  <rule id="100110" level="10">
    <decoded_as>syslog</decoded_as>
    <match>general_ChromaV1ToYUV444</match>
    <description>CVE-2026-85090: FreeRDP AVC444 chroma OOB read triggered - potential info leak / DoS</description>
    <group>cve-2026-85090,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100111" level="12">
    <if_sid>100110</if_sid>
    <match>fatal|segfault|SIGSEGV|access violation</match>
    <description>CVE-2026-85090: FreeRDP client segfault after AVC444 chroma OOB access - likely exploitation impact</description>
    <group>cve-2026-85090,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No patch evidence from any tracked source. The claimed fixed version is FreeRDP 3.31.0, but no official vendor source confirms this.

1. Immediate Mitigations

   • Disable RemoteFX and AVC444 codec support in FreeRDP client settings (/rfx and /gfx flags should not force AVC444). Provide flag /gfx-h264:off to force fallback to other codecs.
   • If RemoteFX must remain active, restrict outbound RDP to trusted hosts and enforce destination allow-listing via firewall rules; avoid connecting to unknown RDP services.
   • Monitor client endpoints for unexpected crashes in xfreerdp or related processes (check /var/log/syslog and /var/log/messages for segfault events).
   • Segment RDP client systems into a dedicated network zone requiring explicit egress approval for RDP connectivity.

2. Patch/Upgrade Steps

   • As the affected version range is < 3.31.0, watch for FreeRDP 3.31.0 release availability on the official GitHub repository (github.com/FreeRDP/FreeRDP).
   • When available, rebuild FreeRDP from source using the tagged release 3.31.0 or greater, or pull from your distro's testing repositories once the upstream version lands there.
   • Run a regression test capturing baseline RDP connectivity against your internal test server before wide rollout.

3. Long-Term Hardening

   • Implement an RDP gateway/broker to intercept and validate RemoteFX streams before they reach FreeRDP clients; this limits the direct-to-client attack path.
   • Use signed TLS certificates for RDP servers and implement mutual authentication where feasible to reduce lure efficacy — this prevents attackers from easily hosting authentic-looking untrusted servers.
   • Subscribe to FreeRDP security mailing lists or GitHub watch notifications so a patch for CVE-2026-85090 is applied immediately on release.
   • Enable address space layout randomization (ASLR) to reduce readability of adjacent heap memory minimizing leakage risk.

References

1. NVD Entry — CVE-2026-85090: https://nvd.nist.gov/vuln/detail/CVE-2026-85090
2. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. FreeRDP GitHub Repository: https://github.com/FreeRDP/FreeRDP — Monitor for version 3.31.0 release and security advisories
4. Roundcube/FreeRDP Mailing List: check for official FreeRDP security bulletins when announced: https://lists.freerdp.com
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat actor activity

At publication time, there are no reported exploitation campaigns or indicators of in-the-wild activity for CVE-2026-85090. The CVE has not been added to the CISA KEV (Known Exploited Vulnerabilities) catalog, EPSS has no score assigned, no PoC or exploit code exists publicly, and no Nuclei template has been published. The lack of patch evidence combined with no vendor advisory suggests the vulnerability may be under embargoed or post-disclosure pre-coordination. Continuous monitoring for FreeRDP upstream release 3.31.0 is strongly recommended.