High severity7.5NVD Advisory· Published Mar 30, 2026· Updated Apr 1, 2026

CVE-2026-33986

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Freerdp/Freerdp2 versions
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*range: <3.24.2
- (no CPE)range: <3.24.2
osv-coords3 versions
pkg:rpm/opensuse/freerdp&distro=openSUSE%20Tumbleweed pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 3.24.2-1.1+ 2 more
- (no CPE)range: < 3.24.2-1.1
- (no CPE)range: < 3.26.0-160000.1.1
- (no CPE)range: < 3.26.0-160000.1.1

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/commit/f6e43e208958140074ae9bb93cd0c9045a371c77nvdPatch
github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97nvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000