Freerdp · Freerdp · CVE-2026-33984
**Name of the Vulnerable Software and Affected Versions**
FreeRDP versions prior to 3.24.2
**Description**
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a heap buffer overflow exists in the `resize vbar entry()` function located in `libfreerdp/codec/clear.c`. Specifically, the `vBarEntry->size` variable is updated to `vBarEntry->count` before the `winpr aligned recalloc()` call. If the reallocation fails, the `size` variable becomes inflated while the `pixels` pointer still references the original, smaller buffer. A subsequent call, where `count` is less than or equal to the inflated `size`, bypasses the reallocation process. This allows the caller to write `count * bpp` bytes of attacker-controlled pixel data into the undersized buffer, resulting in a heap buffer overflow.
**Recommendations**
Versions prior to 3.24.2 should be updated to version 3.24.2 or later.