CVE-2026-67291 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability exists within FreeRDP versions prior to 3.29.0, specifically affecting versions up to and including 3.28.0, presenting a critical heap out-of-bounds read condition in the remote desktop protocol client implementation. This flaw resides in the update_process_glyph_fragments function within libfreerdp/cache/glyph.c, where the system processes GLYPH_FRAGMENT_ADD updates received from remote servers. The core technical issue stems from inadequate input validation during buffer handling operations, specifically when processing glyph fragment data that is transmitted over the RDP protocol.
The vulnerability manifests when a malicious RDP server sends a crafted GLYPH_FRAGMENT_ADD update containing a one-byte declared fragment size that exceeds the actual available buffer space. The code performs no bounds checking to verify whether the declared fragment size fits within the remaining received buffer before proceeding with memory allocation and data copying operations. This fundamental oversight allows an attacker to manipulate the size parameter to reference memory locations beyond the allocated buffer boundaries, triggering a heap out-of-bounds read condition that ultimately leads to client application crash.
This vulnerability directly maps to CWE-125, which identifies out-of-bounds read conditions in software implementations, and aligns with ATT&CK technique T1071.004 for application layer protocol manipulation. The operational impact of this flaw extends beyond simple client instability, as it can be exploited to achieve remote code execution under certain conditions, particularly when combined with other memory corruption vulnerabilities within the FreeRDP stack. Attackers exploiting this vulnerability can cause denial of service through client crashes or potentially escalate privileges if the application lacks proper memory protection mechanisms.
The security implications are significant for organizations relying on FreeRDP implementations for remote desktop connectivity, as a single malicious RDP server could compromise client systems without requiring authentication or user interaction beyond establishing the connection. Organizations should prioritize immediate patching to version 3.29.0 or later, while implementing network segmentation controls to limit exposure to untrusted RDP servers. Additional mitigations include deploying intrusion detection systems that can identify suspicious RDP traffic patterns and configuring firewalls to restrict RDP connections to trusted networks only. The vulnerability demonstrates the critical importance of robust input validation in protocol implementations and highlights the need for comprehensive buffer overflow protection mechanisms in remote desktop clients.