CVE-2026-33987 Details
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This issue has been patched in version 3.24.2.
A heap out-of-bounds write vulnerability has been identified in FreeRDP versions prior to 3.24.2. The issue arises in the 'persistent_cache_read_entry_v3' function within 'libfreerdp/cache/persistent.c'. The vulnerability occurs because 'persistent->bmpSize' is updated before the 'winpr_aligned_recalloc' function is called. If the reallocation fails, 'bmpSize' is incorrectly increased while 'bmpData' still points to the old buffer. This desynchronization allows 'fread' to write data into an undersized buffer, potentially leading to memory corruption.
Users can upgrade to FreeRDP version 3.24.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.24.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |