CVE-2026-67291: FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in updateprocessglyphfragments()/glyphcachefragmentput() in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GLYPH_FRAGMENT_ADD - Compensating control
If you must run an affected FreeRDP version, restrict RDP client connections to trusted RDP servers only (e.g., block outbound RDP/3389 and only allow connections to known-good hosts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67291?
The severity of CVE-2026-67291 is high with a CVSS score of 7.5.
How do I fix CVE-2026-67291?
To fix CVE-2026-67291, upgrade FreeRDP to version 3.29.0 or later.
What vulnerability does CVE-2026-67291 exploit?
CVE-2026-67291 exploits a heap out-of-bounds read when processing GLYPH_FRAGMENT_ADD updates.
Which versions of FreeRDP are affected by CVE-2026-67291?
FreeRDP versions 3.28.0 and earlier are affected by CVE-2026-67291.
What impact does CVE-2026-67291 have on systems?
CVE-2026-67291 can lead to a denial of service due to an out-of-bounds read.