CVE-2026-40033 Details
Description
FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.
A heap-buffer-overflow vulnerability has been identified in FreeRDP versions prior to 3.26.0, specifically within the gdi_CacheToSurface function. This vulnerability allows remote attackers to write out-of-bounds data to heap memory. The issue arises because the function's rectangle validation process clamps coordinates to UINT16_MAX, but the actual copy operations use unclamped dimensions from the cache entry. As a result, malicious RDP servers can exploit this flaw by sending large, crafted RDPGFX PDUs that trigger significant out-of-bounds writes. This exploitation could lead to remote code execution or cause the FreeRDP client to crash.
Users can upgrade to FreeRDP version 3.26.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-787 | Out-of-bounds Write | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.26.0 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |