CVE-2026-33986CWE-122CWE-131

FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write

High · published March 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuv_ensure_buffer() in libfreerdp/codec/h264.c, h264->width and h264->height are updated before the reallocation loop. If any winpr_aligned_recalloc() call fails, the function returns FALSE but width/height are already inflated. This issue has been patched in version 3.24.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.7th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-131 · Incorrect Calculation of Buffer Size
Published
2026-03-30T21:43Z
EPSS history
Timeline
  • 30 MAR 21:43Z
    FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write
    cvelistv5