Heap Buffer Overflow in FreeRDP by FreeRDP

CVE-2026-40033

What is CVE-2026-40033?

A heap-buffer-overflow vulnerability exists in FreeRDP versions prior to 3.26.0, specifically found in the gdi_CacheToSurface function. This vulnerability allows remote attackers to perform out-of-bounds heap memory writes due to improper rectangle validation. While the coordinates are clamped to UINT16_MAX, the copy operations use unvalidated cache entry dimensions, enabling malicious Remote Desktop Protocol (RDP) servers to trigger large out-of-bounds writes. Consequently, this could lead to remote code execution or cause the client to crash, posing significant risks to system integrity.

References