Buffer Overflow in FreeRDP H264 Codec Causes Memory Corruption

Publication date: 2026-03-30

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-30

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-03-31

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33986

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.24.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been patched in FreeRDP version 3.24.2. To mitigate this vulnerability, you should update FreeRDP to version 3.24.2 or later.

Executive Summary

This vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol, specifically in the function yuv_ensure_buffer() within the file libfreerdp/codec/h264.c. Before version 3.24.2, the width and height parameters (h264->width and h264->height) are updated before a memory reallocation loop. If the memory reallocation call (winpr_aligned_recalloc()) fails, the function returns FALSE, but the width and height values have already been increased. This can lead to inconsistent or inflated buffer sizes.

Impact Analysis

The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high severity. It can be exploited remotely without privileges but requires user interaction. The impact includes high confidentiality, integrity, and availability risks. Because the width and height values are inflated even if memory allocation fails, this could lead to memory corruption, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service.

Hi! I’m here to help you understand CVE-2026-33986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70