CVE-2026-33985

FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

State: Published
Severity: 5.9 Medium
Published: Mar 30, 2026
Updated: Mar 31, 2026
Reserved: Mar 24, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L	GitHub_M

Weaknesses

CWE-125 Out-of-bounds Read
CWE-131 Incorrect Calculation of Buffer Size

Affected Products

Product	Versions
FreeRDPFreeRDP	< 3.24.2Affected

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85
https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.