8.6 High

CVE-2026-40033 FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

Description

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: Passive
Confidentiality: High
Integrity: High
Availability: High
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
FreeRDP 3.26	earliest → < 3.26.0	3.26.0
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat Enterprise Linux AppStream (v. 10)	Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)	Versions not published