CVE-2026-33985
7.1
HIGH
CVSS 3.1
EPSS 0.05%
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, pixel data from adjacent heap memory is rendered to screen, potentially leaking sensitive data to the attacker. This issue has been patched in version 3.24.2.
How to fix CVE-2026-33985
To remediate CVE-2026-33985, upgrade the affected package to a fixed version below.
- Debian/freerdp2—no fix listed
- —upgrade to 3.15.0+dfsg-2.1+deb13u2 or later
Is CVE-2026-33985 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0
- from 0, < 3.15.0+dfsg-2.1+deb13u2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |