PT-2026-29140 · Freerdp+1 · Freerdp+1

Calvinytt · Publicado 2026-01-01 · Atualizado 2026-06-15 · CVE-2026-33987

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an issue exists in the persistent cache read entry v3() function within libfreerdp/cache/persistent.c. Specifically, the persistent->bmpSize variable is updated before the winpr aligned recalloc() function is called. If the realloc operation fails, bmpSize becomes inflated while bmpData continues to point to the original buffer.

Recommendations Update to version 3.24.2 or later.

Exploit

Correção

DoS

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-131

CWE-122

Identificadores relacionados

ALSA-2026:16014

BDU:2026-04673

CVE-2026-33987

GHSA-FF8H-P5VC-WCWC

OPENSUSE-SU-2026:10633-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:21436-1

Produtos afetados

Freerdp

Red Os

Referências · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33987.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/1a890eb43492b5eb707cb3dd6fc908f696e8fc1c · Correção
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-25997 · Nota
• https://access.redhat.com/security/cve/CVE-2026-33985 · Nota
• https://errata.almalinux.org/10/ALSA-2026-16014.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33986 · Nota
• https://osv.dev/vulnerability/CVE-2026-33987 · Aviso do Fabricante
• https://bugzilla.redhat.com/2453218 · Nota
• https://access.redhat.com/security/cve/CVE-2026-26986 · Nota
• https://bugzilla.redhat.com/2453226 · Nota
• https://access.redhat.com/security/cve/CVE-2026-25952 · Nota
• https://suse.com/security/cve/CVE-2026-33984 · Nota
• https://cve.org/CVERecord?id=CVE-2026-33987 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33987 · Aviso do Fabricante