CVE-2026-67291: FreeRDP Buffer Overflow Vulnerability

CVE-2026-67291 Overview

CVE-2026-67291 is a heap out-of-bounds read in FreeRDP, an open source implementation of the Remote Desktop Protocol (RDP). The flaw resides in update_process_glyph_fragments() and glyph_cache_fragment_put() within libfreerdp/cache/glyph.c. When the client handles a GLYPH_FRAGMENT_ADD update, it trusts a one-byte server-controlled fragment size without validating it against the remaining received buffer. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read past the allocated buffer and crash. FreeRDP versions up to and including 3.28.0 are affected; the issue is fixed in 3.29.0. The weakness is tracked as CWE-125.

Critical Impact
A malicious or compromised RDP server can crash any connecting FreeRDP client, producing a network-triggered denial of service against workstations and jump hosts.

Affected Products

FreeRDP versions <= 3.28.0
FreeRDP-based clients and forks that include libfreerdp/cache/glyph.c
Downstream distributions shipping FreeRDP prior to 3.29.0

Discovery Timeline

2026-08-01 - CVE-2026-67291 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67291

Vulnerability Analysis

The vulnerability affects the glyph cache subsystem in FreeRDP, which processes drawing primitives sent by an RDP server. Order updates of type GLYPH_FRAGMENT_ADD are parsed inside update_process_glyph_fragments() and stored through glyph_cache_fragment_put(). The parser reads a single byte from the wire that declares the size of the fragment payload, then allocates a buffer and copies that many bytes. The declared size is never compared to the number of bytes actually remaining in the received stream. A server that sends a truncated update with an inflated size field forces the client to read attacker-influenced bytes past the end of the receive buffer, producing an out-of-bounds read that terminates the client process.

Root Cause

The root cause is missing bounds validation on untrusted network input. The one-byte fragment length is treated as authoritative rather than as a candidate that must be checked against the actual Stream_GetRemainingLength() before allocation and memcpy. This is a classic CWE-125 out-of-bounds read stemming from insufficient input validation in a protocol parser.

Attack Vector

Exploitation requires a victim to connect an unpatched FreeRDP client to an attacker-controlled or compromised RDP server. No authentication or user interaction beyond initiating the RDP session is required. Common attack scenarios include phishing users into launching .rdp files that reference hostile servers, DNS or ARP redirection of legitimate RDP traffic, and abuse of shared jump-host infrastructure. Impact is limited to availability: the client crashes, but confidentiality and integrity are not directly affected.

No public proof-of-concept exploit has been released. The vulnerability mechanism is documented in the FreeRDP GHSA-hgj8-g595-wfc6 advisory and the corresponding VulnCheck advisory.

Detection Methods for CVE-2026-67291

Indicators of Compromise

Repeated unexpected termination of freerdp, xfreerdp, or wlfreerdp client processes shortly after establishing an RDP session.
Core dumps or crash reports referencing update_process_glyph_fragments or glyph_cache_fragment_put in libfreerdp/cache/glyph.c.
Outbound RDP (tcp/3389) sessions to servers outside sanctioned management ranges immediately preceding client crashes.

Detection Strategies

Inventory endpoints for FreeRDP binaries and libraries at versions <= 3.28.0 using software asset management or endpoint telemetry.
Alert on RDP client processes exiting abnormally with signals such as SIGSEGV while a TCP session to port 3389 is active.
Correlate RDP connection logs with unusual destination servers, particularly newly registered domains or non-corporate IP ranges.

Monitoring Recommendations

Log outbound RDP connections at network egress and baseline expected destination servers per user population.
Forward endpoint crash telemetry and process termination events into the SIEM for correlation with RDP session metadata.
Track FreeRDP package versions across Linux fleets through configuration management and flag hosts pinned below 3.29.0.

How to Mitigate CVE-2026-67291

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all managed endpoints and container images.
Restrict outbound RDP (tcp/3389) from user workstations to an allowlist of trusted internal servers.
Advise users not to open unsolicited .rdp files or connect to unverified remote desktop hosts.

Patch Information

The fix is included in FreeRDP 3.29.0. Maintainers added bounds checks so that the declared fragment size is validated against the remaining stream length before allocation and copy. See the upstream FreeRDP commit f3b4347 and the GHSA-hgj8-g595-wfc6 advisory for details. Distribution maintainers should backport the fix to any long-term support branches shipping the 3.x series.

Workarounds

Where immediate patching is not possible, block outbound RDP from FreeRDP hosts except to a curated set of known-good servers.
Route RDP traffic through an RDP gateway or bastion that terminates and re-originates sessions from a hardened, patched client.
Disable glyph caching via client configuration on affected FreeRDP builds if operationally acceptable to reduce exposure to the vulnerable code path.

bash

# Verify installed FreeRDP client version and upgrade on Debian/Ubuntu
xfreerdp --version
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Restrict outbound RDP from workstations to an internal allowlist (iptables)
sudo iptables -A OUTPUT -p tcp --dport 3389 -d 10.10.20.0/24 -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 3389 -j REJECT