Junglewise Threat Intelligence

CVE-2026-33984: FreeRDP heap buffer overflow in ClearCodec resize_vbar_entry

CVE-2026-33984 · Severity: high · CVSS 7.5 · Published 2026-03-30

Technologies: FreeRDP, Red Hat Enterprise Linux. Vendors: FreeRDP, Red Hat.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol (RDP). A security flaw has been identified where a malicious remote server could send specially crafted image data to a user's computer, causing the FreeRDP application to crash or potentially allow the attacker to run unauthorized code. This could lead to a full compromise of the user's workstation or theft of sensitive information during a remote desktop session.

Technical details

A heap-based buffer overflow exists in FreeRDP's ClearCodec implementation within the `resize_vbar_entry()` function in `libfreerdp/codec/clear.c`. The vulnerability is caused by an incorrect state update where `vBarEntry->size` is updated to `vBarEntry->count` before the `winpr_aligned_recalloc()` call. If the reallocation fails (e.g., under memory pressure), the size variable remains at the inflated value while the pixel pointer still references the original, smaller buffer. A subsequent call with a count less than or equal to the inflated size will skip reallocation, leading to an out-of-bounds write of attacker-controlled pixel data. This can be exploited by a malicious RDP server to achieve arbitrary code execution or a denial of service. The issue is patched in version 3.24.2.

Affected products

  • FreeRDP FreeRDP < 3.24.2
  • Red Hat Enterprise Linux 8, 9, 10

Timeline

  • 2026-03-25: advisory: GitHub Security Advisory published
  • 2026-03-30: disclosed: NVD publication date
  • 2026-04-27: patched: Red Hat released security updates for RHEL

References

Related threats