HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67291 — FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bound...

·Source: NIST NVD

Updated:

Executive Summary

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes.

Analysis

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes. A malicious RDP server can send a short fragment with an oversized declared size, causing the client to read beyond the allocated buffer, resulting in an out-of-bounds read and client crash. CVSS Score: 7.5. Published: 2026-08-01T13:16:58.097.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67291
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 1, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

N-Able Flaw Exposes MSPs to Worst Case Scenario

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/n-able-flaw-exposes-msps-to-worst-case-scenario-image_small-10-a-32397.jpg" align=right hspace=4><b>Remote Management and Monitoring Tools Widely Used by Managed Security Providers</b><br>Remote management and monitoring software developer N-Able published a second hotfix to patch a vulnerability in all versions of its N-central s

Bank Info Security
MEDIUMVulnerabilityNEW

Hackers steal 31,000 records identifying people behind Liechtenstein companies, foundations

A cyberattack compromised tens of thousands of records related to companies, foundations and trusts in Liechtenstein, prompting the government to to form a “crisis unit” to address the breach.

The Record
HIGHVulnerability

NVD HIGH: CVE-2026-67611 — OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allow...

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client via the unauthenticated registration endpoint and use the password grant to exchange credenti

CVE-2026-67611
NIST NVD