CVE-2026-33987

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an issue exists in the persistent cache read entry v3() function within libfreerdp/cache/persistent.c. Specifically, the persistent->bmpSize variable is updated before the winpr aligned recalloc() function is called. If the realloc operation fails, bmpSize becomes inflated while bmpData continues to point to the original buffer.

Recommendations Update to version 3.24.2 or later.