CVE-2026-67291

FreeRDP before 3.29.0 (versions 3.28.0 and earlier) contains a heap out-of-bounds read (CWE-125) in update_process_glyph_fragments() and glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When the client processes a GLYPH_FRAGMENT_ADD cache update, it trusts a one-byte, server-controlled declared fragment size without checking that it fits within the remaining received buffer, then allocates and copies that many bytes. A malicious or compromised RDP server can send a short fragment carrying an oversized declared size, causing the FreeRDP client to read beyond the allocated heap buffer and crash; the CVSS 4.0 rating of 8.7 reflects high availability impact only, with no confidentiality or integrity impact listed. Anyone running affected FreeRDP-based RDP clients that connect to untrusted or attacker-controlled servers is exposed, and this is a client-side flaw rather than a server-side one. Exploitation is not in CISA KEV, EPSS is low at 0.4% (29th percentile), and one public advisory/PoC reference exists (GHSA-hgj8-g595-wfc6).

What to do: Upgrade to FreeRDP 3.29.0 or later; for distribution-packaged or downstream FreeRDP-based clients, install the updated libfreerdp packages from your vendor as they become available and confirm the running build is 3.29.0+. Until patched, avoid connecting FreeRDP clients to untrusted or attacker-controlled RDP servers, since a crafted GLYPH_FRAGMENT_ADD update from the server is sufficient to crash the client. Note this is a denial-of-service (client crash) issue, not code execution, so patching is moderate urgency but straightforward.