CVE-2026-40033: Freerdp

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

Affected products

• Freerdp Freerdp: before 3.26.0 (fixed in 3.26.0)

Published 2026-05-26. Last modified 2026-07-27.