CVE-2026-33986

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. In versions prior to 3.24.2, the yuv ensure buffer() function within libfreerdp/codec/h264.c updates h264->width and h264->height before the reallocation loop. If a call to winpr aligned recalloc() fails, the function returns FALSE, but the width and height variables are already inflated, potentially leading to issues.

Recommendations Update to version 3.24.2 or later.