CVE-2026-33984
published 2026-03-30CVE-2026-33984: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size…
PriorityP345high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.40%
32.3th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.24.2+dfsg-1 (forky) | freerdp3 3.24.2+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.24.2+dfsg-1 (forky) | freerdp3 3.24.2+dfsg-1 (forky) |
| freerdp | freerdp | < 3.24.2 | 3.24.2 |
| ubuntu | freerdp3 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-07-20
CVE-2026-33995 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
vendor_redhat·2026-03-30·CVSS 7.5
CVE-2026-33984 [HIGH] CWE-131 FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a he
Debian
CVE-2026-33984: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
vendor_debian·2026·CVSS 7.5
CVE-2026-33984 [HIGH] CVE-2026-33984: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
Scope: local
bookworm: open
bullseye: open
VulDB
FreeRDP up to 3.24.1 libfreerdp/codec/clear.c resize_vbar_entry heap-based overflow (EUVD-2026-17229 / Nessus ID 306776)
vuldb·2026-07-02·CVSS 7.5
CVE-2026-33984 [HIGH] FreeRDP up to 3.24.1 libfreerdp/codec/clear.c resize_vbar_entry heap-based overflow (EUVD-2026-17229 / Nessus ID 306776)
A vulnerability was found in FreeRDP up to 3.24.1 and classified as critical. This affects the function resize_vbar_entry of the file libfreerdp/codec/clear.c. Executing a manipulation can lead to heap-based buffer overflow.
The identification of this vulnerability is CVE-2026-33984. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
OSV
CVE-2026-33984: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-03-30·CVSS 7.5
CVE-2026-33984 [HIGH] CVE-2026-33984: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33984 FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
bugzilla·2026-03-30·CVSS 7.5
CVE-2026-33984 [HIGH] CVE-2026-33984 FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
CVE-2026-33984 FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via
Wiz
CVE-2026-33984 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-33984 [HIGH] CVE-2026-33984 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33984 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.
Source : NVD
## 7.5
Score
Published March 30, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
NixOS
Wolfi
Has Public Exploit No
H
https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6https://access.redhat.com/errata/RHSA-2026:10709https://access.redhat.com/errata/RHSA-2026:11332https://access.redhat.com/errata/RHSA-2026:11333https://access.redhat.com/errata/RHSA-2026:11336https://access.redhat.com/errata/RHSA-2026:11649https://access.redhat.com/errata/RHSA-2026:11651https://access.redhat.com/errata/RHSA-2026:12359https://access.redhat.com/errata/RHSA-2026:12388https://access.redhat.com/errata/RHSA-2026:19033https://access.redhat.com/errata/RHSA-2026:19349https://access.redhat.com/errata/RHSA-2026:8457https://access.redhat.com/errata/RHSA-2026:8458https://access.redhat.com/errata/RHSA-2026:8945https://access.redhat.com/errata/RHSA-2026:9656https://access.redhat.com/security/cve/CVE-2026-33984https://bugzilla.redhat.com/show_bug.cgi?id=2453219https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33984.json
2026-03-30
Published