CVE-2026-33984 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP should prioritize updating to version 3.24.2 or later. Additionally, defenders and security teams should be aware of the potential for exploitation and monitor for suspicious activity. This vulnerability has a CVSS score of 7.5 and is considered high severity.

Technical summary

The vulnerability exists in the resize_vbar_entry() function in libfreerdp/codec/clear.c. An attacker can exploit this vulnerability by providing malicious pixel data, leading to a heap buffer overflow. The issue arises when vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow.

Defensive priority

High priority should be given to updating FreeRDP to version 3.24.2 or later. Defenders should also monitor for suspicious activity and implement compensating controls to prevent exploitation.

Recommended defensive actions

• Update FreeRDP to version 3.24.2 or later
• Monitor for suspicious activity
• Implement compensating controls to prevent exploitation
• Review and update vulnerability management processes
• Conduct regular security audits and risk assessments

Evidence notes

The CVE-2026-33984 vulnerability was patched in version 3.24.2 of FreeRDP. The vulnerability has a CVSS score of 7.5 and is considered high severity. The vulnerability exists in the resize_vbar_entry() function in libfreerdp/codec/clear.c. The issue arises when vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.