Heap Out-of-Bounds Read/Write in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-29775

What is CVE-2026-29775?

FreeRDP, an open-source implementation of the Remote Desktop Protocol, contains a vulnerability in its bitmap cache subsystem prior to version 3.24.0. This issue arises from an off-by-one error in the boundary check within the 'bitmap_cache_put' function, which leads to client-side heap out-of-bounds read/write operations. A malicious server can exploit this flaw by sending a CACHE_BITMAP_ORDER (Rev1) with a cacheId set to maxCells, effectively bypassing the guard and accessing the 'cells[]' array one element beyond the allocated size. This vulnerability has been addressed in version 3.24.0.

References