CVE-2026-33982

HIGH EPSS 8.9%
Published Mar 30, 20263mo ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Mar 30, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.

CVSS Details

Base Score
8.1
Exploitability
2.8
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
8.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 1

VendorProductVersionRange
freerdpfreerdp* <3.24.2

References 2

  • github.com https://github.com/FreeRDP/FreeRDP/commit/a48dbde2c8a5b8b70a9d1c045d969a71afd6284c
    Patch
  • github.com https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/FreeRDP/FreeRDP/commit/a48dbde2c8a5b8b70a9d1c045d969a71afd6284c
    Patch
  • github.com https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2
    MitigationPatchVendor Advisory