CVE-2026-33986
Buffer Overflow in FreeRDP H264 Codec Causes Memory Corruption
Publication date: 2026-03-30
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freerdp | freerdp | to 3.24.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-131 | The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been patched in FreeRDP version 3.24.2. To mitigate this vulnerability, you should update FreeRDP to version 3.24.2 or later.
Can you explain this vulnerability to me?
This vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol, specifically in the function yuv_ensure_buffer() within the file libfreerdp/codec/h264.c. Before version 3.24.2, the width and height parameters (h264->width and h264->height) are updated before a memory reallocation loop. If the memory reallocation call (winpr_aligned_recalloc()) fails, the function returns FALSE, but the width and height values have already been increased. This can lead to inconsistent or inflated buffer sizes.
How can this vulnerability impact me? :
The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high severity. It can be exploited remotely without privileges but requires user interaction. The impact includes high confidentiality, integrity, and availability risks. Because the width and height values are inflated even if memory allocation fails, this could lead to memory corruption, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service.