Heap Buffer Overflow in FreeRDP Affected Software
CVE-2026-33982

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
30 March 2026

What is CVE-2026-33982?

A heap buffer overflow vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.24.2. This flaw arises due to an improper memory allocation handling in the function winpr_aligned_offset_recalloc(), allowing unauthorized access to memory. This may result in the compromise of system integrity and confidentiality. Users are strongly advised to upgrade to version 3.24.2 or later to mitigate potential risks.

Affected Version(s)

FreeRDP < 3.24.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/a48dbde2c8a5b8b...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.