CVE-2026-67291

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

Weakness classification

• disclosure@vulncheck.com: CWE-125

Primary references

• disclosure@vulncheck.com — Patch
• disclosure@vulncheck.com — Exploit, Vendor Advisory
• disclosure@vulncheck.com — Patch, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory