CVE-2026-33987
Heap Overflow in FreeRDP Persistent Cache Causes Memory Corruption
Publication date: 2026-03-30
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freerdp | freerdp | to 3.24.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-131 | The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol, in versions prior to 3.24.2. The issue occurs in the function persistent_cache_read_entry_v3() within the file libfreerdp/cache/persistent.c. Specifically, the variable persistent->bmpSize is updated before a memory reallocation function (winpr_aligned_recalloc()) is called. If this reallocation fails, bmpSize becomes inflated while bmpData still points to the old memory buffer, leading to inconsistent state and potential memory corruption.
How can this vulnerability impact me? :
The vulnerability can lead to memory corruption due to the mismatch between bmpSize and the actual memory buffer bmpData points to. According to the CVSS score (7.1), it has a low attack vector (local), low attack complexity, no privileges required, but requires user interaction. The impact includes high integrity and availability damage, meaning an attacker could potentially cause application crashes or manipulate data, disrupting service or causing denial of service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update FreeRDP to version 3.24.2 or later, where the issue has been patched.