CVE-2026-33985

MEDIUM

FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read

Title source: cna

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.

References (2)

Scores

CVSS v3 5.9
EPSS 0.0004
EPSS Percentile 13.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-125 CWE-131
Status published
Products (2)
freerdp/freerdp < 3.24.2
FreeRDP/FreeRDP < 3.24.2
Published Mar 30, 2026
Tracked Since Mar 31, 2026