# CVE-2026-29774: freerdp3-shadow-x11: FreeRDP is a free implementation of the Remote Desktop Protocol

CVE-2026-29774 is fixed in 23 products on 1 platform, first by DEBIAN-CVE-2026-29774, released March 13, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-29774
- Priority: High
- CVSS: 8.2 (Medium)
- EPSS: 0.0034
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 13, 2026

## Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path due to missing horizontal bounds validation of H.264 metablock regionRects coordinates.  In yuv.c, the clamp() function (line 347) only validates top/bottom against the surface/YUV height, but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination and source pointers using rect->left, it performs unchecked pointer arithmetic that can reach far beyond the allocated surface buffer. A malicious server sends a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry where left greatly exceeds the surface width (e.g., left=60000 on a 128px surface). The H.264 bitstream decodes successfully, then yuv420_process_work_callback calls avc420_yuv_to_rgb which computes pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region. This vulnerability is fixed in 3.24.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | freerdp amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-debugsource amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-devel amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-libs amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-libs-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-server amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp-server-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | freerdp3 Debian 13.5 (trixie) | 3.15.0+dfsg-2.1+deb13u2 | [DEBIAN-CVE-2026-29774](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29774.md) | Mar 13, 2026 |
| Linux | freerdp3 Debian 14 | 3.24.0+dfsg-1 | [DEBIAN-CVE-2026-29774](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29774.md) | Mar 13, 2026 |
| Linux | freerdp3-shadow-x11 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-shadow-x11 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-shadow-x11-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | freerdp3-wayland Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-wayland 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-wayland-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | freerdp3-x11 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-x11 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-x11-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-client3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-client3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-client3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-server3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-server3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-server3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-shadow-subsystem3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-shadow-subsystem3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-shadow-subsystem3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-shadow3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-shadow3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-shadow3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libwinpr amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | libwinpr-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | libwinpr-devel amzn 2023 | 2:3.6.3-1.amzn2023.0.8 | [ALAS2023-2026-1520](https://patchblox.com/security/data/fix/linux/alas2023-2026-1520.md) | Mar 30, 2026 |
| Linux | libwinpr-tools3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libwinpr-tools3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwinpr-tools3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libwinpr3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libwinpr3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwinpr3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | winpr3-utils Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [winpr3-utils 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-winpr3-utils-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.