CVE-2026-33987

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A memory corruption vulnerability exists in the persistent cache handling. If a memory reallocation fails, an internal size variable is incorrectly updated, while the data pointer still refers to the original, smaller memory block. This can allow a local attacker, through user interaction, to cause a denial of service or potentially execute arbitrary code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid connecting to untrusted Remote Desktop Protocol (RDP) servers or opening untrusted RDP files. Users can also disable persistent caching in FreeRDP by using the --disable-persistent-caching command-line option when launching xfreerdp or similar FreeRDP clients. This may impact performance for frequently accessed RDP sessions.