NVD HIGH: CVE-2026-67291 — FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bound...
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it fits within the remaining received buffer before allocating and copying that many bytes.
CVE-2026-67291