CVE-2026-33985: FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/freerdpto a version that resolves this vulnerability.Fixed in 3.24.2-r0 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.24.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33985?
CVE-2026-33985 is considered a moderate severity vulnerability due to the potential for sensitive data leakage.
How do I fix CVE-2026-33985?
To fix CVE-2026-33985, upgrade FreeRDP to version 3.24.2 or later.
What type of vulnerability is CVE-2026-33985?
CVE-2026-33985 is a heap out-of-bounds read vulnerability.
What software is affected by CVE-2026-33985?
CVE-2026-33985 affects FreeRDP versions prior to 3.24.2.
What could happen if CVE-2026-33985 is exploited?
If exploited, CVE-2026-33985 could allow attackers to leak sensitive information from adjacent heap memory.