PT-2026-29137 · Freerdp+1 · Freerdp+1
Calvinytt
·
Published
2026-01-01
·
Updated
2026-04-28
·
CVE-2026-33984
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.24.2
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a heap buffer overflow exists in the
resize vbar entry() function located in libfreerdp/codec/clear.c. Specifically, the vBarEntry->size variable is updated to vBarEntry->count before the winpr aligned recalloc() call. If the reallocation fails, the size variable becomes inflated while the pixels pointer still references the original, smaller buffer. A subsequent call, where count is less than or equal to the inflated size, bypasses the reallocation process. This allows the caller to write count * bpp bytes of attacker-controlled pixel data into the undersized buffer, resulting in a heap buffer overflow.Recommendations
Versions prior to 3.24.2 should be updated to version 3.24.2 or later.
Exploit
Fix
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freerdp
Rocky Linux