Out-of-bounds read in FreeRDP - CVE-2026-33985

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125368

Out-of-bounds read in FreeRDP - CVE-2026-33985

Published: April 8, 2026


Vulnerability identifier: #VU125368
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33985
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in clear_decompress_glyph_data() in libfreerdp/codec/clear.c when processing a subsequent CLEARCODEC_FLAG_GLYPH_HIT call after a failed winpr_aligned_recalloc() operation. A remote attacker can send specially crafted ClearCodec glyph data to disclose sensitive information.

Pixel data from adjacent heap memory may be rendered to the screen. User interaction is required.


Affected software

FreeRDP
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
freerdp (Red Hat package)
freerdp
freerdp-devel
freerdp-libs
libwinpr
libwinpr-devel
freerdp-doc
freerdp-debuginfo
freerdp-debugsource
freerdp-help

How to mitigate CVE-2026-33985

Install security update from vendor's website.

FreeRDP - update to 3.24.2
freerdp (Red Hat package) - addressed in versions 2.1.1-5.el7_9.9, 2.2.0-7.el8_6.8, 2.2.0-12.el8_8.8, 2.2.0-14.el8_4, 2.4.1-3.el9_0.7, 2.11.2-1.el9_4.8, 2.11.7-1.el9_6.10, 2.11.7-9.el8_10, 3.10.3-5.el10_1.8
freerdp - update to 2.11.7-9.0.1
freerdp-devel - update to 2.11.7-9.0.1
freerdp-libs - update to 2.11.7-9.0.1
libwinpr - update to 2.11.7-9.0.1
libwinpr-devel - update to 2.11.7-9.0.1
freerdp-doc - update to 2.11.7-9.0.1
freerdp-debuginfo - update to 2.11.8-5
freerdp-debugsource - update to 2.11.8-5
freerdp-help - update to 2.11.8-5
freerdp-devel - update to 2.11.8-5
freerdp - update to 2.11.8-5
libwinpr-devel - update to 2.11.8-5
libwinpr - update to 2.11.8-5
freerdp - addressed in versions 3.24.2-1.fc42, 3.24.2-1.fc43, 3.24.2-1.fc44

External References

Related Security Bulletins