Security readout for executives and security teams
Plain-English summary
FreeRDP versions before 3.24.2 have a memory-corruption flaw in H.264 video handling. A user must interact with an RDP session, and exploitation is rated high but high-complexity. Successful exploitation could compromise confidentiality, integrity, and availability of the FreeRDP process.
Executive priority
Treat as high priority for environments that rely on FreeRDP for remote administration or support. Patch promptly, but do not treat as confirmed exploited based on the supplied evidence.
Technical view
In libfreerdp/codec/h264.c, yuv_ensure_buffer() updates h264 width and height before all aligned reallocations succeed. If a winpr_aligned_recalloc() call fails, stale allocation state can remain with inflated dimensions, enabling a heap out-of-bounds write. Patched in FreeRDP 3.24.2.
Likely exposure
Organizations are exposed where FreeRDP versions earlier than 3.24.2 are installed, especially on administrator, support, jump-host, or Linux desktop systems used for RDP access.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. CVSS indicates network reachability, no privileges, required user interaction, high attack complexity, and high confidentiality, integrity, and availability impact.
Researcher notes
Focus review on H.264 buffer resizing and failure paths in yuv_ensure_buffer(). The key issue is dimension state changing before all reallocations succeed, causing allocation-size desynchronization after a failed allocation.
Mitigation direction
- Upgrade FreeRDP to version 3.24.2 or later.
- Check operating-system vendor advisories for packaged FreeRDP fixes.
- Prioritize systems used to access sensitive RDP environments.
- Limit FreeRDP use with untrusted or unmanaged RDP servers.
- Monitor vendor guidance for any additional mitigations or package status.
Validation and detection
- Inventory installed FreeRDP versions across workstations, servers, and images.
- Confirm all FreeRDP packages are version 3.24.2 or vendor-patched.
- Review remote-access workflows that depend on FreeRDP clients.
- Check Red Hat or distribution advisories for affected package status.
- Record remediation exceptions where upgrade is not immediately possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-131: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-33986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-30T22:01:33.630Z: Reported to Red Hat.
- 2026-03-30T21:43:21.951Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/FreeRDP/FreeRDP/commit/f6e43e208958140074ae9bb93cd0c9045a371c77CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33986CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2453221CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33986.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Incorrect Calculation of Buffer Size
Incorrect Calculation of Buffer Size represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.