CVE-2026-33983: FreeRDP denial of service in progressive_decompress_tile_upgrade

CVE-2026-33983 · Severity: medium · CVSS 6.5 · Published 2026-03-30

FreeRDP, a popular tool for connecting to remote Windows desktops, contains a flaw that can cause the application to freeze. By sending a specially crafted remote desktop message, an attacker can force the software into an infinite loop, consuming all available processor power. This results in a denial-of-service, making the remote desktop connection unusable and potentially impacting the stability of the host system.

Technologies: FreeRDP, Red Hat Enterprise Linux AppStream. Vendors: FreeRDP, Red Hat.

Quick answers

Is CVE-2026-33983 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33983 being exploited in the wild.
How severe is CVE-2026-33983?
Medium severity, with a CVSS score of 6.5, published 30 March 2026.
Which products and versions are affected?
FreeRDP <= 3.24.1; Red Hat Enterprise Linux AppStream 8.0.
Is there a fix for CVE-2026-33983?
A patch was published on 2026-03-25: Fix committed to FreeRDP repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33983 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33983?
Check whether you run FreeRDP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in FreeRDP's progressive_decompress_tile_upgrade() function due to improper handling of return values and integer underflow. When progressive_rfx_quant_cmp_equal() detects a mismatch, the system logs a warning but continues execution using a wrapped value (247) as a shift exponent. This leads to undefined behavior and an approximately 80 billion iteration loop, resulting in complete CPU exhaustion (DoS). The attack is delivered via the network but requires user interaction (connecting to a malicious RDP server). The issue is patched in version 3.24.2 by failing the operation on invalid values or validating bit counts after subtraction.

Affected products

  • FreeRDP FreeRDP <= 3.24.1
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8) 8.0
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.0

Timeline

  • 2026-03-25: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-30: disclosed: NVD publication date
  • 2026-03-25: patched: Fix committed to FreeRDP repository
  • 2026-04-27: patched: Red Hat released security updates for RHEL 9.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.