Buffer Management Issue in FreeRDP Remote Desktop Protocol Implementation
CVE-2026-33987

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
30 March 2026

What is CVE-2026-33987?

A flaw in the FreeRDP implementation of the Remote Desktop Protocol could result in improper buffer management. Specifically, in the function persistent_cache_read_entry_v3() located in libfreerdp/cache/persistent.c, the updating of persistent->bmpSize occurs before executing winpr_aligned_recalloc(). If realloc fails, the bmpSize can be incorrectly inflated, leaving bmpData pointing to an outdated buffer. This vulnerability highlights the importance of proper memory management practices and was addressed in version 3.24.2 of FreeRDP.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FreeRDP < 3.24.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/1a890eb43492b5e...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.