Junglewise Threat Intelligence

CVE-2026-33986: FreeRDP heap buffer overflow in H.264 codec

CVE-2026-33986 · Severity: high · CVSS 7.5 · Published 2026-03-30

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers. A security flaw in how it handles video data (H.264) could allow a malicious remote server to crash the application or potentially execute unauthorized code on the user's machine. This occurs when a user connects to a compromised or malicious server that sends specially crafted video frames.

Technical details

A heap-based buffer overflow (CWE-122) exists in libfreerdp/codec/h264.c within the yuv_ensure_buffer() function. The vulnerability is caused by updating the H264_CONTEXT width and height dimensions before the winpr_aligned_recalloc() reallocation loop. If a reallocation fails, the function returns FALSE but leaves the internal state with 'inflated' dimensions; subsequent calls may skip reallocation while using the old, smaller buffers for large decoded YUV data. An attacker controlling a malicious RDP server can exploit this via RDPGFX AVC420 frames to trigger a massive heap overflow (up to 33MB). The issue is fixed in version 3.24.2 by deferring dimension updates until after successful allocation.

Affected products

  • FreeRDP FreeRDP < 3.24.2
  • Red Hat Enterprise Linux 6 All
  • Red Hat Enterprise Linux 7 All

Timeline

  • 2026-03-25: advisory: GitHub Security Advisory published
  • 2026-03-30: disclosed: CVE published to NVD
  • 2026-03-30: patched: Fix committed to main branch

References

Related threats