PT-2026-29139 · Freerdp+1 · Freerdp+1

Calvinytt · Publicado 2026-01-01 · Atualizado 2026-06-15 · CVE-2026-33986

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. In versions prior to 3.24.2, the yuv ensure buffer() function within libfreerdp/codec/h264.c updates h264->width and h264->height before the reallocation loop. If a call to winpr aligned recalloc() fails, the function returns FALSE, but the width and height variables are already inflated, potentially leading to issues.

Recommendations Update to version 3.24.2 or later.

Exploit

Correção

DoS

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-131

CWE-122

Identificadores relacionados

BDU:2026-04495

CVE-2026-33986

GHSA-H6QW-WXVM-HF97

OPENSUSE-SU-2026:10633-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:21436-1

Produtos afetados

Freerdp

Red Os

Referências · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33986.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97 · Aviso do Fabricante
• https://github.com/FreeRDP/FreeRDP/commit/f6e43e208958140074ae9bb93cd0c9045a371c77 · Correção
• https://suse.com/security/cve/CVE-2026-33982 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-freerdp3-cve-2026-33986-8.0 · Nota
• https://suse.com/security/cve/CVE-2026-33986 · Nota
• https://bdu.fstec.ru/vul/2026-04495 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-33983 · Nota
• https://suse.com/security/cve/CVE-2026-33984 · Nota
• https://twitter.com/CVEnew/status/2038916070099362210 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33995 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33986 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-33986 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-33987 · Nota
• https://suse.com/security/cve/CVE-2026-33977 · Nota