CVE-2026-67291 FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

Q: Is CVE-2026-67291 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67291 exists.

High 8.7 Published 1 Aug 2026 Updated 3 Aug 2026

A malicious RDP server can trigger a heap out-of-bounds read in FreeRDP clients, causing a crash via crafted glyph fragment updates.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-67291?

CVE-2026-67291 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash.

Weakness: CWE-125

Which versions are affected by CVE-2026-67291?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-67291?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-67291 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67291 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-67291, GHSA-hgj8-g595-wfc6, GHSA-qx25-fqx8-cgm7, UBUNTU-CVE-2026-67291.