CVE-2026-23732
HIGHFreeRDP < 3.21.0 - Heap-based Buffer Overflow via FastGlyph Parsing
Title source: llmDescription
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.
References (6)
Core 6
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp
Product x_refsource_misc
https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/cache/glyph.c#L463-L480
Product x_refsource_misc
https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/codec/color.c#L261-L277
Product x_refsource_misc
https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/graphics.c#L138
Product x_refsource_misc
https://github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/orders.c#L2186C17-L2199
Release Notes x_refsource_misc
https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
Scores
CVSS v3
7.5
EPSS
0.0048
EPSS Percentile
37.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-122
Status
published
Products (1)
freerdp/freerdp
< 3.21.0
Published
Jan 19, 2026
Tracked Since
Feb 18, 2026