PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40033 FreeRDP CVE debrief

A heap-buffer-overflow vulnerability exists in FreeRDP versions prior to 3.26.0 within the gdi_CacheToSurface function. The flaw stems from a validation logic error: rectangle coordinates are clamped to UINT16_MAX during bounds checking, but subsequent copy operations use unclamped cache entry dimensions. This discrepancy allows a malicious RDP server to trigger out-of-bounds heap writes, potentially leading to remote code execution or client crash. The vulnerability was disclosed on 2026-05-26 and is currently undergoing analysis in the NVD. No known exploitation in ransomware campaigns has been reported.

Vendor
FreeRDP
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-27
Advisory published
2026-05-26
Advisory updated
2026-07-27

Who should care

Organizations using FreeRDP clients to connect to RDP servers, particularly those in environments where RDP server trust cannot be guaranteed. Security teams responsible for endpoint protection and remote access infrastructure. Developers integrating FreeRDP libraries into custom applications.

Technical summary

The vulnerability resides in the gdi_CacheToSurface function where rectangle validation clamps coordinates to UINT16_MAX but fails to apply the same clamping to cache entry dimensions used in copy operations. This allows a malicious RDP server to supply crafted cache entries with dimensions exceeding the clamped bounds, resulting in out-of-bounds heap writes during surface blitting operations. The CVSS 4.0 score of 8.7 reflects high impacts across confidentiality, integrity, and availability with network accessibility and low attack complexity.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade FreeRDP to version 3.26.0 or later to remediate the heap-buffer-overflow vulnerability
  • Review and restrict RDP server connections to trusted sources only, as the vulnerability requires a malicious server to exploit
  • Monitor for anomalous FreeRDP client crashes or memory corruption indicators that may signal exploitation attempts
  • Apply principle of least privilege for RDP client processes to limit impact of potential code execution
  • Consider network segmentation to isolate RDP client systems from untrusted networks until patching is complete

Evidence notes

Vulnerability description and technical details sourced from NVD entry and Vulncheck advisory. Patch commit and GitHub Security Advisory confirm fix availability. CVSS 4.0 vector indicates network attack vector with low attack complexity and high impact to confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40033 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40033

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40033 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40033

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.