Out-of-bounds read in FreeRDP - CVE-2026-33985
Published: April 8, 2026
Vulnerability identifier: #VU125368
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-33985
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: FreeRDP
Affected software:
FreeRDP
FreeRDP
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in clear_decompress_glyph_data() in libfreerdp/codec/clear.c when processing a subsequent CLEARCODEC_FLAG_GLYPH_HIT call after a failed winpr_aligned_recalloc() operation. A remote attacker can send specially crafted ClearCodec glyph data to disclose sensitive information.
Pixel data from adjacent heap memory may be rendered to the screen. User interaction is required.
How to mitigate CVE-2026-33985
Install security update from vendor's website.