FreeRDP CVE-2026-67291

The victim must initiate an RDP client session using FreeRDP <= 3.28.0 to a server controlled or influenced by the attacker. No special client-side configuration is required - the vulnerable code path in the glyph cache is reached through the standard RDP drawing order protocol, which is a default part of RDP sessions. The critical prerequisite is attacker control over the server side of the RDP connection: this can be achieved via a rogue RDP server the victim is socially engineered to connect to, a compromised legitimate RDP server, or a man-in-the-middle position on the network (the latter requires additional attack capability and is a separate prerequisite). Exploitation is limited to the client process only (Scope:Unchanged); it does not affect the server or other systems. The CVSS vector PR:N reflects that no client-side authentication or privilege is required from the attacker - they operate the server, not the client.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) conveys that this vulnerability is remotely exploitable with no complexity, no required privileges, and no user interaction beyond the user connecting to an RDP server - which is the product's intended use. The CVSS 4.0 UI:N metric warrants scrutiny: connecting to a malicious server does require a user to initiate a session, which some assessors would classify as UI:P in CVSS 4.0 terms; this is a minor interpretive difference and does not substantially alter risk. The primary impact is VA:H (full client crash), with no confidentiality or integrity impact per the CVSS vector - however, the 'Information Disclosure' tag from intelligence sources suggests heap memory contents may also be exposed during the OOB read, a nuance the base CVSS vector does not capture. EPSS data was not provided in the intelligence feed. No CISA KEV listing exists, and no public proof-of-concept has been identified, meaning exploitation requires crafting a malicious RDP server or performing a man-in-the-middle attack. Real-world risk is high for organizations permitting users to connect to external or untrusted RDP servers, but significantly mitigated in environments where users only connect to known, trusted, internal RDP infrastructure.

An attacker operates a rogue RDP server (or performs a man-in-the-middle attack against an unencrypted or certificate-ignored RDP session) and waits for a FreeRDP client running version <= 3.28.0 to connect. Once the RDP session is established, the attacker sends a crafted GLYPH_FRAGMENT_ADD drawing order PDU in which the declared fragment size byte is set to a value far exceeding the actual bytes in the packet; the FreeRDP client reads beyond the heap-allocated buffer, causing a process crash and potentially leaking adjacent heap memory contents to the attacker via RDP error reporting or side-channel. No public proof-of-concept exploit code has been identified at time of analysis, but the exploitation mechanic is straightforward for any attacker capable of operating or impersonating an RDP server.