Heap Out-of-Bounds Read in FreeRDP Affects Multiple Versions

CVE-2026-67291

What is CVE-2026-67291?

FreeRDP versions prior to 3.29.0 are susceptible to a heap out-of-bounds read due to inadequate validation of server-controlled glyph fragment sizes. When the client processes updates with the GLYPH_FRAGMENT_ADD command, it may read an oversized declared fragment size without confirming that it fits within the bounds of the received buffer. This flaw allows a malicious RDP server to send a manipulated fragment, leading to an out-of-bounds read, which can result in crashes and potential instability for the client.

References