CVE-2026-67291

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

Published Aug 1, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

Analysis

Technical impact

The vulnerability arises in FreeRDP versions prior to 3.29.0, where the glyph cache update functions read a size value supplied by the remote server without checking that it fits into the remaining received data. This out-of-bounds read can expose arbitrary client memory contents and causes a crash, resulting in a denial of service. The flaw is a classic heap read out of bounds (CWE-125).

Affected Systems

FreeRDP deployments using any release version 3.28.0 or older are affected. The issue is present in the core glyph handling module of the client library. Systems running these versions should consider an upgrade to 3.29.0 or later, which removes the unvalidated copy operation.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is rated high. The EPSS score is not available, so the current probability of exploitation is unclear, but the flaw is listed in no KEV catalog. A malicious RDP server can send a crafted GLYPH_FRAGMENT_ADD update that declares a fragment size longer than the transmitted data, allowing an attacker to trigger the out-of-bounds read from any remote host that accepts their connection. This attack requires network access to the vulnerable client and does not depend on local privileges; the impact is deterministic crash, not a remote code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`0`	affected	< 3.29.0
`3.29.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[0,3.29.0)`	affected	generic	—
`3.29.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest FreeRDP 3.29.0 or newer to eliminate the vulnerability.
Configure the client to connect only to trusted RDP servers and limit graphical updates if possible.
Use network segmentation or VPN to isolate RDP connections from untrusted hosts.

Generated by OpenCVE AI on August 2, 2026 at 02:55 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.410% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6
https://nvd.nist.gov/vuln/detail/CVE-2026-67291
https://www.cve.org/CVERecord?id=CVE-2026-67291
https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add

History

Aug 6, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-67291 https://www.cve.org/CVERecord?id=CVE-2026-67291
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 3, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
Title		FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-125
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hgj8-g595-wfc6 https://www.vulncheck.com/advisories/freerdp-before-heap-out-of-bounds-read-via-glyph-fragment-add
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`