CVE-2026-33983

MEDIUM

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

Title source: cna
STIX 2.1

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.

References (19)

Core 19
Core References

Scores

CVSS v3 6.5
EPSS 0.0043
EPSS Percentile 35.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-190 CWE-252
Status published
Products (2)
freerdp/freerdp < 3.24.2
FreeRDP/FreeRDP < 3.24.2
Published Mar 30, 2026
Tracked Since Mar 31, 2026