High severity · published Mar 30, 2026
CVE-2026-33985
FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
FreeRDP · FreeRDP
< 3.24.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33985
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33985
Patch
https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25
Patch
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85
More from FreeRDP
9.8
CVE-2026-63633
FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
9.8
CVE-2026-55194
FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
9.8
CVE-2026-55191
FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
9.8
CVE-2026-66402
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
9.8
CVE-2026-57156
FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing