Junglewise Threat Intelligence

CVE-2026-33983: FreeRDP denial of service in progressive_decompress_tile_upgrade

CVE-2026-33983 · Severity: medium · CVSS 6.5 · Published 2026-03-30

Technologies: Red Hat Enterprise Linux AppStream, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP, a popular tool for connecting to remote Windows desktops, contains a flaw that can cause the application to freeze. By sending a specially crafted remote desktop message, an attacker can force the software into an infinite loop, consuming all available processor power. This results in a denial-of-service, making the remote desktop connection unusable and potentially impacting the stability of the host system.

Technical details

A vulnerability exists in FreeRDP's progressive_decompress_tile_upgrade() function due to improper handling of return values and integer underflow. When progressive_rfx_quant_cmp_equal() detects a mismatch, the system logs a warning but continues execution using a wrapped value (247) as a shift exponent. This leads to undefined behavior and an approximately 80 billion iteration loop, resulting in complete CPU exhaustion (DoS). The attack is delivered via the network but requires user interaction (connecting to a malicious RDP server). The issue is patched in version 3.24.2 by failing the operation on invalid values or validating bit counts after subtraction.

Affected products

  • FreeRDP FreeRDP <= 3.24.1
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8) 8.0
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.0

Timeline

  • 2026-03-25: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-30: disclosed: NVD publication date
  • 2026-03-25: patched: Fix committed to FreeRDP repository
  • 2026-04-27: patched: Red Hat released security updates for RHEL 9.4

References

Related threats