CVE-2026-33987

Katalog CVE

CVSS 6.6 · Medium EPSS 0,15%

Kerentanan Heap-based Buffer Overflow pada freerdp. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in persistent_cache_read_entry_v3() in libfreerdp/cache/persistent.c, persistent->bmpSize is updated before winpr_aligned_recalloc(). If realloc fails, bmpSize is inflated while bmpData points to the old buffer. This issue has been patched in version 3.24.2.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc patch · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/1a890eb43492b5eb707cb3dd6fc908f696e8fc1c patch