Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:18 FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-125

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

A heap out-of-bounds read vulnerability in FreeRDP allows an unauthenticated, malicious RDP server to cause a Denial of Service. By sending a specially crafted glyph fragment update, the server forces the client to read beyond its allocated memory, crashing the application.

A Moderate heap out-of-bounds read in FreeRDP affects Red Hat products by allowing an untrusted RDP server to remotely crash a connecting client without authentication, resulting in a loss of application availability. To mitigate this issue, avoid connecting FreeRDP clients to untrusted or potentially malicious RDP servers. If such connections are required, run the client on a dedicated, isolated system so a client crash is contained and does not impact other workloads. Red Hat Enterprise Linux 10 2026-08-31T00:00:00Z RHSA-2026:61378 freerdp-2:3.10.3-12.el10_2.10 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-09-17T00:00:00Z RHSA-2026:68706 freerdp-2:3.10.3-3.el10_0.16 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-09-17T00:00:00Z RHSA-2026:68707 freerdp-0:2.1.1-5.el7_9.12 Red Hat Enterprise Linux 8 2026-09-02T00:00:00Z RHSA-2026:62571 freerdp-2:2.11.7-12.el8_10 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-09-09T00:00:00Z RHSA-2026:65855 freerdp-2:2.2.0-14.el8_4.3 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-09-09T00:00:00Z RHSA-2026:65855 freerdp-2:2.2.0-14.el8_4.3 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-09-10T00:00:00Z RHSA-2026:66281 freerdp-2:2.2.0-7.el8_6.12 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-09-10T00:00:00Z RHSA-2026:66281 freerdp-2:2.2.0-7.el8_6.12 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-09-10T00:00:00Z RHSA-2026:66282 freerdp-2:2.2.0-12.el8_8.11 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-09-10T00:00:00Z RHSA-2026:66282 freerdp-2:2.2.0-12.el8_8.11 Red Hat Enterprise Linux 9 2026-08-31T00:00:00Z RHSA-2026:61379 freerdp-2:2.11.7-7.el9_8.6 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-09-24T00:00:00Z RHSA-2026:71388 freerdp-2:2.4.1-6.el9_2.12 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-09-24T00:00:00Z RHSA-2026:71390 freerdp-2:2.11.2-1.el9_4.11 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-09-24T00:00:00Z RHSA-2026:71387 freerdp-2:2.11.7-1.el9_6.13 Red Hat Enterprise Linux 6 Out of support scope freerdp https://www.cve.org/CVERecord?id=CVE-2026-67291 https://nvd.nist.gov/vuln/detail/CVE-2026-67291 https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6 https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add