CVE-2026-33983

MEDIUM

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

Title source: cna
STIX 2.1

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0025
EPSS Percentile 16.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-190 CWE-252
Status published
Products (2)
freerdp/freerdp < 3.24.2
FreeRDP/FreeRDP < 3.24.2
Published Mar 30, 2026
Tracked Since Mar 31, 2026