Red Hat CVE-2026-33987

Upgrade to FreeRDP version 3.24.2 or later, which contains the complete fix for the heap buffer overflow via commit 1a890eb43492b5eb707cb3dd6fc908f696e8fc1c. The patch corrects the order of operations in persistent_cache_read_entry_v3() to ensure bmpSize is only updated after successful memory reallocation, eliminating the size/pointer desynchronization. For Linux distributions, apply vendor-provided security updates through standard package managers (apt, yum, dnf) as Ubuntu and Debian maintainers release patched packages for tracked releases. Organizations unable to immediately upgrade should implement defense-in-depth controls: restrict RDP client usage to trusted connection sources only, disable persistent bitmap caching if operationally feasible via FreeRDP configuration options, and deploy endpoint detection solutions to monitor for abnormal RDP client behavior or crashes. Review and sanitize any RDP connection files (.rdp) from untrusted sources before use. System administrators should audit environments for applications embedding vulnerable libfreerdp versions and coordinate updates with application vendors. Full technical details and patch available at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc and commit reference https://github.com/FreeRDP/FreeRDP/commit/1a890eb43492b5eb707cb3dd6fc908f696e8fc1c.