CVE-2026-67291 Details
Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
A heap out-of-bounds read vulnerability has been identified in FreeRDP versions prior to 3.29.0, specifically in the update_process_glyph_fragments and glyph_cache_fragment_put functions within libfreerdp/cache/glyph.c. The issue arises when the software processes a GLYPH_FRAGMENT_ADD update. The code reads a one-byte fragment size declared by the server but fails to verify that this size is appropriate for the remaining buffer before allocating memory and copying data. As a result, a malicious RDP server can send a fragment with a larger declared size than the actual data, causing the client to read beyond its allocated memory, leading to a crash.
Users can upgrade to FreeRDP version 3.29.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6 | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.29.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |