Vulnerability · Published May 26, 2026 · Assigned by VulnCheck

CVE-2026-40033FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

High 8.8

In plain English

A high-severity heap buffer overflow in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.4%top 28.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	freerdp	2:3.10.3-12.el10_2.6	ALSA-2026:36203
AlmaLinux:10	freerdp-devel	2:3.10.3-12.el10_2.6	ALSA-2026:36203
AlmaLinux:10	freerdp-libs	2:3.10.3-12.el10_2.6	ALSA-2026:36203
AlmaLinux:10	freerdp-server	2:3.10.3-12.el10_2.6	ALSA-2026:36203
AlmaLinux:10	libwinpr	2:3.10.3-12.el10_2.6	ALSA-2026:36203
AlmaLinux:10	libwinpr-devel	2:3.10.3-12.el10_2.6	ALSA-2026:36203
Debian:12	freerdp2	no fix listed	DEBIAN-CVE-2026-40033
Debian:13	freerdp3	no fix listed	DEBIAN-CVE-2026-40033
Debian:14	freerdp3	3.26.0+dfsg-1	DEBIAN-CVE-2026-40033
Rocky Linux:10	freerdp	2:3.10.3-12.el10_2.6	RLSA-2026:36203
Ubuntu:22.04:LTS	freerdp2	no fix listed	UBUNTU-CVE-2026-40033
Ubuntu:24.04:LTS	freerdp3	3.30.0+dfsg-0ubuntu0.24.04.1	UBUNTU-CVE-2026-40033
Ubuntu:24.04:LTS	freerdp3	3.30.0+dfsg-0ubuntu0.24.04.1	USN-8561-1
Ubuntu:25.10	freerdp3	no fix listed	UBUNTU-CVE-2026-40033
Ubuntu:26.04:LTS	freerdp3	3.30.0+dfsg-0ubuntu0.26.04.1	UBUNTU-CVE-2026-40033
Ubuntu:26.04:LTS	freerdp3	3.30.0+dfsg-0ubuntu0.26.04.1	USN-8561-1

Affected products (as reported)

Vendor	Product	Versions
FreeRDP	FreeRDP	0 – before 3.26.0

Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff vendor-advisory
https://github.com/FreeRDP/FreeRDP/pull/12713 issue-tracking
https://github.com/FreeRDP/FreeRDP/commit/d7508ebcd82842a691ae4941e5104d14240a89ae patch
https://www.vulncheck.com/advisories/freerdp-heap-buffer-overflow-in-gdi-cachetosurface-via-rectangle-validation-bypass third-party-advisory
https://access.redhat.com/security/cve/CVE-2026-40033 vdb-entry, x_refsource_REDHAT
RHBZ#2481473 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40033.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:46393 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36203 vendor-advisory, x_refsource_REDHAT