FreeRDP CVE-2026-67291

|

EUVD

EUVD-2026-51823 HIGH

Out-of-bounds Read (CWE-125)

2026-08-01 VulnCheck

GHSA-qx25-fqx8-cgm7

Buffer Overflow Information Disclosure Freerdp

8.7

CVSS 4.0 · Vendor: VulnCheck

Share

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

User must actively connect to a malicious server (UI:R); OOB read may expose heap memory (C:L); client process crash yields A:H; no privileges required on the client system (PR:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

X

Lifecycle Timeline

3

Source Code Evidence Fetched

Aug 01, 2026 - 13:10 vuln.today

Analysis Generated

Aug 01, 2026 - 13:10 vuln.today

CVE Published

Aug 01, 2026 - 12:22 cve.org

HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

AnalysisAI

Heap out-of-bounds read in FreeRDP's glyph cache subsystem (versions <= 3.28.0) allows a malicious or compromised RDP server to crash any connecting FreeRDP client by sending a GLYPH_FRAGMENT_ADD update with a server-controlled declared fragment size that exceeds the actual received buffer. The vulnerability exists because update_process_glyph_fragments() and glyph_cache_fragment_put() in libfreerdp/cache/glyph.c read a one-byte declared size and proceed to allocate and copy that many bytes without first validating that the declared size fits within the remaining data in the received packet. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with AV:N/AC:L/PR:N reflects trivial remote exploitation requiring only a client connection to a rogue server.

Technical ContextAI

FreeRDP is a widely-used open-source implementation of the Remote Desktop Protocol (RDP) client, affected across all versions before 3.29.0 per CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*. The flaw resides in the RDP glyph drawing order subsystem (libfreerdp/cache/glyph.c), specifically in how GLYPH_FRAGMENT_ADD cache update PDUs are parsed. RDP uses a glyph cache mechanism to transmit font/text rendering data efficiently; the GLYPH_FRAGMENT_ADD command embeds a one-byte field for the declared fragment data size. CWE-125 (Out-of-bounds Read) applies because the code trusts this server-supplied byte to drive both memory allocation and a subsequent copy operation, never verifying that the declared length is bounded by the actual bytes remaining in the received RDP PDU. This class of bug enables an attacker with control over the RDP server-side stream to force the client to read heap memory beyond the allocated buffer, resulting in process crash and potentially exposing adjacent heap contents (consistent with the 'Information Disclosure' tag from intelligence sources).

RemediationAI

The primary remediation is to upgrade FreeRDP to version 3.29.0 or later, which includes the fix introduced in commit f3b4347105114fe7453828736bea069999af319f (https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f). The full vendor security advisory is available at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6 and the VulnCheck advisory at https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add. Where immediate patching is not possible, the most effective compensating control is to restrict FreeRDP clients to connecting only to trusted, internally controlled RDP servers via network policy (firewall rules or VPN-gated access), which removes attacker ability to serve malicious RDP PDUs. Disabling glyph caching at the client configuration level (if exposed via xfreerdp flags such as disabling RemoteFX or glyph cache negotiation) may serve as a workaround but requires testing for rendering regressions. Organizations should also audit any environments where users connect to external or third-party RDP servers, as those represent the primary exposure surface.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

Share

CVE-2026-67291 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy