GHSA-x6gr-8p7h-5h85: FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

Q: Which FreeRDP versions need remediation?

FreeRDP versions prior to 3.24.2 are affected. The issue is patched in FreeRDP 3.24.2.

Q: What could an attacker obtain if exploitation succeeds?

Adjacent heap memory pixel data can be rendered on screen, which can expose sensitive data to the attacker.

Q: What attacker interaction is indicated by the severity vector?

The vector indicates network reachability, no required privileges, and user interaction. It also indicates high confidentiality impact and low availability impact.

Published Mar 30, 2026

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

Affected Software

1 affected component

FreeRDP freerdp<3.24.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.24.2

Event History

Mar 30, 2026

CVE Published

via OSV·09:43 PM

Data Sourced

via OSV·09:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FreeRDP versions need remediation?

FreeRDP versions prior to 3.24.2 are affected. The issue is patched in FreeRDP 3.24.2.

What could an attacker obtain if exploitation succeeds?

Adjacent heap memory pixel data can be rendered on screen, which can expose sensitive data to the attacker.

What attacker interaction is indicated by the severity vector?

The vector indicates network reachability, no required privileges, and user interaction. It also indicates high confidentiality impact and low availability impact.

GHSA-x6gr-8p7h-5h85: FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

Affected Software

Remediation

Event History

Frequently Asked Questions

Which FreeRDP versions need remediation?

What could an attacker obtain if exploitation succeeds?

What attacker interaction is indicated by the severity vector?

Company

Resources

Contact

Frequently Asked Questions

Which FreeRDP versions need remediation?

What could an attacker obtain if exploitation succeeds?

What attacker interaction is indicated by the severity vector?