Vulnerability details

CVE-2026-33982

FreeRDP FreeRDP

FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read

CVSS 3.1

7.1High

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
FreeRDP	FreeRDP	< 3.24.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2 x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/a48dbde2c8a5b8b70a9d1c045d969a71afd6284c x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-31
Last updated: 2026-03-31
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.19%

Probability of exploitation in 30 days

9.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-125
Out-of-bounds Read