Heap Buffer Overflow in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-33984

What is CVE-2026-33984?

FreeRDP, an open-source implementation of the Remote Desktop Protocol, is susceptible to a heap buffer overflow that arises from improper memory management. Specifically, in the function resize_vbar_entry() found in libfreerdp/codec/clear.c, the error occurs when the size of vBarEntry is mistakenly assigned to vBarEntry->count before a memory reallocation is requested. If this reallocation fails, the size inadvertently reflects a larger value while pointing to a smaller, original buffer. Consequently, this can lead to unsafe writing of attacker-controlled pixel data into the buffer, risking application stability and data integrity. A fix has been implemented in version 3.24.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References