CVE-2026-67291: freerdp Out-of-bounds Read

Vulnerability summary

CVE-2026-67291 is a high (CVSS 8.7) Out-of-bounds Read vulnerability in freerdp. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.