CVE-2026-67291 FreeRDP CVE debrief

Who should care

Users of FreeRDP versions before 3.29.0 should apply patches to prevent potential client crashes. This includes administrators and security teams responsible for managing and securing systems that use FreeRDP. Additionally, operators and platform administrators should be aware of the vulnerability and take steps to mitigate it. Vulnerability management and security teams should prioritize patching to prevent potential client crashes and data breaches. Compensating controls, such as restricting RDP access to trusted servers and monitoring for suspicious RDP activity, can also be implemented while remediation is scheduled and verified. Asset inventory and rollback/change windows should be reviewed to ensure timely patching and minimize potential impact. Source tracking and exposure review should also be conducted to identify and address potential vulnerabilities. Monitoring and detection capabilities should be reviewed to ensure that potential security incidents related to this vulnerability can be identified and responded to effectively. The CVE record was published on 2026-08-01T13:16:58.097Z and has not been modified since then. Evidence is based on limited source detail; further verification is recommended. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review compensating controls for exposed systems while remediation is scheduled and verified. Compensating controls for exposed systems while remediation is scheduled and verified should be reviewed. Compensating controls, such as restricting RDP access to trusted servers and monitoring for suspicious RDP activity, can also be implemented while remediation is scheduled and verified. Asset inventory and rollback/change windows

Technical summary

CVE-2026-67291 is a heap out-of-bounds read vulnerability in FreeRDP before version 3.29.0. The issue occurs in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in a client crash. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Users of FreeRDP versions before 3.29.0 should apply patches to prevent potential client crashes. The issue was fixed in FreeRDP version 3.29.0.

Defensive priority

FreeRDP users should prioritize patching to prevent potential client crashes.

Recommended defensive actions

• Update FreeRDP to version 3.29.0 or later
• Restrict RDP access to trusted servers
• Monitor for suspicious RDP activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-67291 record indicates a heap out-of-bounds read in FreeRDP before version 3.29.0. The issue is in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. A malicious RDP server can exploit this by sending a short fragment with an oversized declared size, causing a client crash. Evidence is based on limited source detail; further verification is recommended.

Official resources