CVE-2026-29775: FreeRDP Buffer Overflow Vulnerability

CVE-2026-29775 Overview

CVE-2026-29775 is a heap out-of-bounds read/write vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The vulnerability exists in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in the bitmap_cache_put function. A malicious server can exploit this flaw by sending a crafted CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard condition and accessing the cells[] array one element past the allocated boundary. This vulnerability is classified as CWE-787 (Out-of-bounds Write) and has been fixed in FreeRDP version 3.24.0.

Critical Impact
Remote attackers controlling a malicious RDP server can trigger memory corruption on connecting FreeRDP clients, potentially leading to denial of service or limited integrity compromise through out-of-bounds memory access.

Affected Products

FreeRDP versions prior to 3.24.0
All platforms running vulnerable FreeRDP client implementations
Applications and systems integrating the FreeRDP library

Discovery Timeline

2026-03-13 - CVE-2026-29775 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-29775

Vulnerability Analysis

The vulnerability resides in FreeRDP's bitmap cache handling code within libfreerdp/cache/bitmap.c. When a FreeRDP client connects to a malicious RDP server, the server can send specially crafted bitmap cache orders that exploit an off-by-one error in the boundary validation logic. The bitmap_cache_put function fails to properly validate the cacheId parameter against the allocated array size, allowing an attacker to specify a cacheId value equal to maxCells. Since array indexing is zero-based, accessing index maxCells when only maxCells elements are allocated results in accessing memory one element beyond the array boundary.

This out-of-bounds access can lead to heap memory corruption, potentially causing client crashes (denial of service) or allowing limited memory manipulation. The attack is network-exploitable and requires no authentication, though it does require user interaction in the form of connecting to a malicious server.

Root Cause

The root cause is an off-by-one boundary check error in the bitmap cache allocation and access logic. The original code allocated exactly BitmapCacheV2NumCells elements for the cells array, but the boundary validation allowed cacheId values up to and including BitmapCacheV2NumCells, when it should only allow values up to BitmapCacheV2NumCells - 1. This classic off-by-one vulnerability pattern creates a one-element overflow condition when the maximum cacheId is used.

Attack Vector

The attack vector is network-based and requires a victim FreeRDP client to connect to a malicious RDP server under attacker control. The attacker-controlled server sends a CACHE_BITMAP_ORDER (Rev1) message containing a cacheId value set to maxCells. When the client processes this order, the off-by-one boundary check allows the operation to proceed, resulting in the client accessing memory outside the allocated cells[] array. This can corrupt adjacent heap memory structures, potentially leading to application crashes or unpredictable behavior.

// Security patch from libfreerdp/cache/bitmap.c
// Fix: Overallocate bitmap cache by 1 element to handle off-by-one from older RDP servers

 	const UINT32 BitmapCacheV2NumCells =
 	    freerdp_settings_get_uint32(settings, FreeRDP_BitmapCacheV2NumCells);
 	bitmapCache->context = context;
-	bitmapCache->cells = (BITMAP_V2_CELL*)calloc(BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));
+
+	/* overallocate by 1. older RDP servers do send a off by 1 cache index. */
+	bitmapCache->cells =
+	    (BITMAP_V2_CELL*)calloc(BitmapCacheV2NumCells + 1ull, sizeof(BITMAP_V2_CELL));

 	if (!bitmapCache->cells)
 		goto fail;

Source: GitHub Commit Changes

Detection Methods for CVE-2026-29775

Indicators of Compromise

Unexpected FreeRDP client crashes when connecting to RDP servers
Memory corruption errors or segmentation faults in FreeRDP processes
Unusual RDP traffic patterns with malformed CACHE_BITMAP_ORDER messages
System logs showing FreeRDP process terminations with heap-related errors

Detection Strategies

Monitor for FreeRDP client crashes that occur during active RDP sessions
Implement network traffic analysis to detect anomalous bitmap cache orders in RDP streams
Deploy endpoint detection rules for heap corruption indicators in FreeRDP processes
Use application crash monitoring to identify patterns consistent with off-by-one exploitation

Monitoring Recommendations

Enable detailed logging for FreeRDP client connections and session events
Monitor system event logs for application crashes involving FreeRDP components
Implement network-level inspection for RDP protocol anomalies where feasible
Track FreeRDP version inventory across the environment to identify vulnerable installations

How to Mitigate CVE-2026-29775

Immediate Actions Required

Upgrade FreeRDP to version 3.24.0 or later immediately
Audit all systems and applications using FreeRDP libraries for vulnerable versions
Restrict RDP connections to trusted servers only until patching is complete
Consider blocking outbound RDP connections to untrusted networks as a temporary measure

Patch Information

FreeRDP has released version 3.24.0 which addresses this vulnerability. The fix overallocates the bitmap cache array by one element to safely handle the off-by-one condition that can occur with certain RDP server implementations. Organizations should update to this version or apply the security commit ffad58fd2b329efd81a3239e9d7e3c927b8e503f to their FreeRDP installations. The GitHub Security Advisory provides additional details about the patch and affected versions.

Workarounds

Only connect to trusted and verified RDP servers until patching is possible
Use network segmentation to limit exposure of systems running vulnerable FreeRDP versions
Deploy application allowlisting to control which RDP clients can execute in the environment
Implement network access controls to prevent connections to untrusted RDP endpoints

bash

# Configuration example - Verify FreeRDP version and update
# Check current FreeRDP version
xfreerdp --version

# Update FreeRDP via package manager (example for Debian/Ubuntu)
sudo apt update && sudo apt install freerdp2-x11

# For source builds, update to version 3.24.0 or later
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.24.0
cmake -B build && cmake --build build
sudo cmake --install build