CVE-2026-33983 in FreeRDP

摘要 (英语)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.

负责

GitHub_M

预定

2026-03-24

披露

2026-03-31

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
354266	FreeRDP progressive_decompress_tile_upgrade 内存损坏	190	未定义	官方修复	CVE-2026-33983