CVE-2026-33987: FreeRDP Buffer Overflow Vulnerability

CVE-2026-33987 Overview

CVE-2026-33987 is a heap buffer overflow vulnerability (CWE-122) in FreeRDP, a free implementation of the Remote Desktop Protocol. The vulnerability exists in the persistent_cache_read_entry_v3() function within libfreerdp/cache/persistent.c. Prior to version 3.24.2, the code updates persistent->bmpSize before calling winpr_aligned_recalloc(). If the reallocation fails, bmpSize becomes inflated while bmpData continues to point to the old, smaller buffer, creating a dangerous state that can lead to integrity and availability impacts.

Critical Impact

A local attacker with low privileges could exploit this heap buffer overflow to cause high integrity and availability impacts through memory corruption when the persistent cache is processed during a Remote Desktop session.

Affected Products

• FreeRDP versions prior to 3.24.2
• Systems using FreeRDP's persistent bitmap cache feature
• Applications built against vulnerable FreeRDP library versions

Discovery Timeline

• 2026-03-30 - CVE-2026-33987 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33987

Vulnerability Analysis

This heap buffer overflow vulnerability stems from improper memory management in FreeRDP's persistent cache implementation. The core issue lies in the order of operations within the persistent_cache_read_entry_v3() function. When processing cache entries, the function updates the bmpSize field to reflect the expected new buffer size before actually performing the memory reallocation via winpr_aligned_recalloc().

If the reallocation operation fails (returns NULL), the code does not properly handle this error condition. The bmpSize variable remains inflated to the new, larger value while bmpData still points to the original, smaller memory buffer. This creates a classic heap buffer overflow scenario where subsequent operations that rely on bmpSize to determine buffer boundaries will operate on memory beyond the actual allocated space.

The vulnerability requires local access and user interaction for exploitation, as an attacker would need to craft a malicious persistent cache file that triggers the memory allocation failure and subsequent buffer overflow condition during a Remote Desktop session.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) variant issue combined with improper error handling. The code modifies state (bmpSize) before confirming the success of the operation (winpr_aligned_recalloc()) that requires that state change. When reallocation fails, there is no rollback of the bmpSize value, leaving the internal state inconsistent with actual memory allocation. This violates secure coding principles that require state changes only after successful completion of dependent operations.

Attack Vector

The attack vector is local with low privileges required and user interaction needed. An attacker could exploit this vulnerability by:

1. Crafting a malicious persistent bitmap cache file designed to trigger memory allocation failure
2. Placing this cache file where the FreeRDP client will read it during session establishment
3. Waiting for a user to initiate a Remote Desktop session that processes the malicious cache
4. The memory allocation failure leads to inconsistent state between bmpSize and actual buffer size
5. Subsequent cache operations write beyond the allocated buffer boundaries, corrupting heap memory

This could result in denial of service through application crash, or potentially allow manipulation of adjacent heap data structures for integrity attacks.

Detection Methods for CVE-2026-33987

Indicators of Compromise

• Unexpected crashes or segmentation faults in FreeRDP client processes during session establishment
• Abnormal memory allocation patterns in libfreerdp cache operations
• Corrupted or unusually large persistent cache files in FreeRDP cache directories
• Application logs showing memory allocation failures followed by cache processing errors

Detection Strategies

• Monitor FreeRDP client processes for abnormal termination signals (SIGSEGV, SIGABRT)
• Implement file integrity monitoring on FreeRDP persistent cache directories
• Deploy endpoint detection rules to identify heap corruption patterns in Remote Desktop clients
• Use memory debugging tools (Valgrind, AddressSanitizer) in development environments to detect buffer overflows

Monitoring Recommendations

• Enable verbose logging in FreeRDP to capture memory allocation failures
• Monitor system logs for repeated crashes in FreeRDP-based applications
• Implement application crash reporting to identify potential exploitation attempts
• Track unusual file modifications in user-specific FreeRDP cache locations

How to Mitigate CVE-2026-33987

Immediate Actions Required

• Upgrade FreeRDP to version 3.24.2 or later immediately
• Disable persistent bitmap caching if upgrade is not immediately possible
• Review and clear existing persistent cache files from affected systems
• Monitor FreeRDP client systems for signs of exploitation or crashes

Patch Information

The vulnerability has been patched in FreeRDP version 3.24.2. The fix is available in commit 1a890eb43492b5eb707cb3dd6fc908f696e8fc1c. The patch ensures that bmpSize is only updated after successful memory reallocation, preventing the inconsistent state that leads to heap buffer overflow. For detailed information about the vulnerability, refer to the GitHub Security Advisory GHSA-ff8h-p5vc-wcwc.

Workarounds

• Disable persistent bitmap caching by setting /cache:bitmap:off in FreeRDP connection parameters
• Remove existing persistent cache files from ~/.local/share/freerdp/ or equivalent cache directories
• Restrict file system permissions on FreeRDP cache directories to prevent malicious cache file placement
• Consider using alternative RDP clients until the upgrade can be performed

# Configuration example - Disable persistent bitmap caching
# Add to FreeRDP connection command
xfreerdp /v:server.example.com /cache:bitmap:off

# Remove existing cache files (Linux/macOS)
rm -rf ~/.local/share/freerdp/cache/

# Set restrictive permissions on cache directory
chmod 700 ~/.local/share/freerdp/