FreeRDP Progressive Codec Uninitialized Memory Disclosure (CVE-2026-33983)

FreeRDP: Uninitialized heap memory rendered to client screen via progressive tile path, default build aborts Vulnerability Overview Vulnerability Description: Uninitialized heap memory is rendered to the client screen in the progressive codec tile upgrade path of FreeRDP. Impact: May lead to information leakage and causes process abortion in default builds. Fix: This vulnerability has been fixed in version 3.32.0. Affected Scope Affected Versions: FreeRDP <= 3.31.1 Fixed Versions: FreeRDP 3.32.0 Remediation Mitigation: This vulnerability was fixed in version 3.32.0. Vulnerability Details Vulnerability Type: - CWE-908 (Use of Uninitialized Resource leading to Information Disclosure) - CWE-617 (Reachable Assertion) Root Cause: Per-tile cumulative buffer allocation without initialization, and the upgrade path unconditionally copies the current buffer, resulting in uninitialized data being rendered. Reason CVE-2026-33983 Fix Did Not Cover This: The fix only checked the return value of but did not handle uninitialized data. Proof of Concept (POC) Reproduction Steps ```bash python3 gen_progressive_uninit.py progressive_uninit.bin python3 gen_upgrade_only_control.py upgrade_only.bin cmake -S . -B build -D Ninja -DCMAKE_BUILD_TYPE=Release \ -DWITH_VERBOSE_WINPR_ASSERT=OFF -DBUILD_SHARED_LIBS=ON \ -DWITH_SERVER=OFF -DWITH_CLIENT=OFF \ --build build --parallel clang -g -O0 -fno-omit-frame-pointer -DDEBUG_SOURCE -o prog_harness prog_harness.c \ -Iinclude -Iinclude/winpr -Iinclude/freerdp -Iwinpr \ -Llib -lfreerdp3 -lfreerdp3-client -lfreerdp3-common -lfreerdp3-codec -lfreerdp3-codec-rfx \ -lfreerdp3-codec-rfx-progressive -lfreerdp3-codec-rfx-progressive-decompress \ -lfreerdp3-codec-rfx-progressive-encode -lfreerdp3-codec-rfx-progressive-quant \ -lfreerdp3-codec-rfx-progressive-quant-sub -lfreerdp3-codec-rfx-progressive-quant-upgrade \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin-progressive_uninit-bin \ -lfreerdp3-codec-rfx-progressive-quant-upgrade-only-control-payload-gen-progressive_uninit-bin-

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP Progressive Codec Uninitialized Memory Disclosure (CVE-2026-33983)

More from this source