Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T18:16:45.003Z",
  "pubdate": "2026-08-19T18:16:45.003Z",
  "executiveSummary": "A heap out-of-bounds read vulnerability exists in FreeRDP prior to version 3.27.0 within the glyph caching subsystem. The flaw specifically resides in the glyph_cache_get function located in libfreerdp/cache/glyph.c, where an incorrect boundary check permits an out-of-bounds array index access.\nA malicious RDP server can exploit this vulnerability by leveraging GLYPH_FRAGMENT_USE replay attacks via update_process_glyph_fragments. This manipulation causes the default cache to receive an index of 254 when cache->number is 254, resulting in a single-pointer read past the boundary of the entries array and subsequent dereference as a glyph object.\nThe successful exploitation of this vulnerability can lead to a denial-of-service condition through application crashes and potentially facilitate adjacent heap data disclosure, exposing sensitive memory contents to an adversarial remote server.\nThe attack requires a malicious or compromised RDP server interacting with a vulnerable FreeRDP client. No specialized authentication or high privileges are required beyond establishing a standard remote desktop connection session with the victim client.",
  "technicalDetails": "The root cause of the vulnerability is an off-by-one bounds-checking error within the glyph_cache_get function implemented in libfreerdp/cache/glyph.c. Specifically, the conditional logic incorrectly evaluates whether the requested cache index is strictly greater than cache->number rather than utilizing a greater-than-or-equal-to comparison operator.\nThe vulnerable component is the client-side glyph cache management subsystem of FreeRDP, which handles rendering optimizations for Remote Desktop Protocol text and glyph fragments. The affected versions comprise all FreeRDP releases prior to version 3.27.0.\nExploitation occurs during the processing of server-to-client update messages involving glyph fragments. An attacker operating a malicious RDP server initiates or replays GLYPH_FRAGMENT_USE commands inside the update_process_glyph_fragments routine. By supplying carefully crafted payload parameters, the server forces the default glyph cache to access index 254 when the maximum allocated cache capacity (cache->number) is also 254.\nBecause the conditional check fails to catch this boundary condition, the execution flow proceeds to read exactly one pointer beyond the allocated bounds of the internal entries array. The application then treats this adjacent heap memory address as a valid pointer to a glyph structure and attempts to dereference it during rendering operations.\nThe post-exploitation impact includes memory corruption manifested as an immediate segmentation fault or application crash, causing a denial of service for the client session. Furthermore, depending on the layout of the adjacent heap memory, dereferencing or processing the out-of-bounds pointer may result in the inadvertent disclosure of sensitive heap data back to the hostile RDP server."
}