# CVE-2026-33984: freerdp3-shadow-x11: FreeRDP is a free implementation of the Remote Desktop Protocol

CVE-2026-33984 is fixed in 23 products on 1 platform, first by RHSA-2026:11333, released March 30, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-33984
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0041
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 30, 2026

## Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in resize_vbar_entry() in libfreerdp/codec/clear.c, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call. If realloc fails, size is inflated while pixels still points to the old, smaller buffer. On a subsequent call where count <= size (the inflated value), realloc is skipped. The caller then writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, causing a heap buffer overflow. This issue has been patched in version 3.24.2.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | freerdp RHEL 10 | 3.10.3-3.el10_0.6 | [RHSA-2026:11333](https://patchblox.com/security/data/fix/linux/rhsa-2026-11333.md) | Mar 30, 2026 |
| Linux | freerdp RHEL 8 | 2:2.11.7-7.el8_10 | [RHSA-2026:8945](https://patchblox.com/security/data/fix/linux/rhsa-2026-8945.md) | Apr 30, 2026 |
| Linux | freerdp RHEL 9 | 2:2.11.7-1.el9_7.6 | [RHSA-2026:8457](https://patchblox.com/security/data/fix/linux/rhsa-2026-8457.md) | Apr 30, 2026 |
| Linux | freerdp almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp almalinux 8 | 2:2.11.7-7.el8_10 | [ALSA-2026:8945](https://patchblox.com/security/data/fix/linux/alsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp almalinux 9 | 2:2.11.7-1.el9_7.6 | [ALSA-2026:8457](https://patchblox.com/security/data/fix/linux/alsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp ol 8 | 2:2.11.7-7.el8_10 | [ELSA-2026-8945](https://patchblox.com/security/data/fix/linux/elsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp ol 9 | 2:2.11.7-1.el9_7.6 | [ELSA-2026-8457](https://patchblox.com/security/data/fix/linux/elsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp rocky 10 | 2:3.10.3-5.el10_1.6 | [RLSA-2026:8458](https://patchblox.com/security/data/fix/linux/rlsa-2026-8458.md) | Apr 18, 2026 |
| Linux | freerdp rocky 8 | 2:2.11.7-7.el8_10 | [RLSA-2026:8945](https://patchblox.com/security/data/fix/linux/rlsa-2026-8945.md) | Apr 23, 2026 |
| Linux | freerdp rocky 9 | 2:2.11.7-1.el9_7.6 | [RLSA-2026:8457](https://patchblox.com/security/data/fix/linux/rlsa-2026-8457.md) | Apr 19, 2026 |
| Linux | freerdp sles 15.7 | 3.10.3-150700.3.17.1 | [SUSE-SU-2026:3562-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3562-1.md) | Aug 10, 2026 |
| Linux | freerdp-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-debugsource amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-devel RHEL 8 | 2:2.11.7-7.el8_10 | [RHSA-2026:8945](https://patchblox.com/security/data/fix/linux/rhsa-2026-8945.md) | Apr 30, 2026 |
| Linux | freerdp-devel RHEL 9 | 2:2.11.7-1.el9_7.6 | [RHSA-2026:8457](https://patchblox.com/security/data/fix/linux/rhsa-2026-8457.md) | Apr 30, 2026 |
| Linux | freerdp-devel almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-devel almalinux 8 | 2:2.11.7-7.el8_10 | [ALSA-2026:8945](https://patchblox.com/security/data/fix/linux/alsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp-devel almalinux 9 | 2:2.11.7-1.el9_7.6 | [ALSA-2026:8457](https://patchblox.com/security/data/fix/linux/alsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp-devel amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-devel ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-devel ol 8 | 2:2.11.7-7.el8_10 | [ELSA-2026-8945](https://patchblox.com/security/data/fix/linux/elsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp-devel ol 9 | 2:2.11.7-1.el9_7.6 | [ELSA-2026-8457](https://patchblox.com/security/data/fix/linux/elsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp-libs RHEL 8 | 2:2.11.7-7.el8_10 | [RHSA-2026:8945](https://patchblox.com/security/data/fix/linux/rhsa-2026-8945.md) | Apr 30, 2026 |
| Linux | freerdp-libs RHEL 9 | 2:2.11.7-1.el9_7.6 | [RHSA-2026:8457](https://patchblox.com/security/data/fix/linux/rhsa-2026-8457.md) | Apr 30, 2026 |
| Linux | freerdp-libs almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-libs almalinux 8 | 2:2.11.7-7.el8_10 | [ALSA-2026:8945](https://patchblox.com/security/data/fix/linux/alsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp-libs almalinux 9 | 2:2.11.7-1.el9_7.6 | [ALSA-2026:8457](https://patchblox.com/security/data/fix/linux/alsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp-libs amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-libs ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-libs ol 8 | 2:2.11.7-7.el8_10 | [ELSA-2026-8945](https://patchblox.com/security/data/fix/linux/elsa-2026-8945.md) | Apr 20, 2026 |
| Linux | freerdp-libs ol 9 | 2:2.11.7-1.el9_7.6 | [ELSA-2026-8457](https://patchblox.com/security/data/fix/linux/elsa-2026-8457.md) | Apr 16, 2026 |
| Linux | freerdp-libs-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-server almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-server amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp-server ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | freerdp-server-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | freerdp3 Debian 13.5 (trixie) | 3.15.0+dfsg-2.1+deb13u2 | [DEBIAN-CVE-2026-33984](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33984.md) | Mar 30, 2026 |
| Linux | freerdp3 Debian 14 | 3.24.2+dfsg-1 | [DEBIAN-CVE-2026-33984](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33984.md) | Mar 30, 2026 |
| Linux | freerdp3-shadow-x11 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-shadow-x11 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-shadow-x11-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | freerdp3-wayland Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-wayland 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-wayland-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | freerdp3-x11 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [freerdp3-x11 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-freerdp3-x11-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-client3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-client3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-client3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-server3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-server3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-server3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-shadow-subsystem3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-shadow-subsystem3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-shadow-subsystem3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp-shadow3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp-shadow3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp-shadow3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libfreerdp3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libfreerdp3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libfreerdp3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libwinpr RHEL 8 | 2:2.11.7-7.el8_10 | [RHSA-2026:8945](https://patchblox.com/security/data/fix/linux/rhsa-2026-8945.md) | Apr 30, 2026 |
| Linux | libwinpr RHEL 9 | 2:2.11.7-1.el9_7.6 | [RHSA-2026:8457](https://patchblox.com/security/data/fix/linux/rhsa-2026-8457.md) | Apr 30, 2026 |
| Linux | libwinpr almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | libwinpr almalinux 8 | 2:2.11.7-7.el8_10 | [ALSA-2026:8945](https://patchblox.com/security/data/fix/linux/alsa-2026-8945.md) | Apr 20, 2026 |
| Linux | libwinpr almalinux 9 | 2:2.11.7-1.el9_7.6 | [ALSA-2026:8457](https://patchblox.com/security/data/fix/linux/alsa-2026-8457.md) | Apr 16, 2026 |
| Linux | libwinpr amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | libwinpr ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | libwinpr ol 8 | 2:2.11.7-7.el8_10 | [ELSA-2026-8945](https://patchblox.com/security/data/fix/linux/elsa-2026-8945.md) | Apr 20, 2026 |
| Linux | libwinpr ol 9 | 2:2.11.7-1.el9_7.6 | [ELSA-2026-8457](https://patchblox.com/security/data/fix/linux/elsa-2026-8457.md) | Apr 16, 2026 |
| Linux | libwinpr-debuginfo amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | libwinpr-devel RHEL 8 | 2:2.11.7-7.el8_10 | [RHSA-2026:8945](https://patchblox.com/security/data/fix/linux/rhsa-2026-8945.md) | Apr 30, 2026 |
| Linux | libwinpr-devel RHEL 9 | 2:2.11.7-1.el9_7.6 | [RHSA-2026:8457](https://patchblox.com/security/data/fix/linux/rhsa-2026-8457.md) | Apr 30, 2026 |
| Linux | libwinpr-devel almalinux 10 | 2:3.10.3-5.el10_1.6 | [ALSA-2026:8458](https://patchblox.com/security/data/fix/linux/alsa-2026-8458.md) | Apr 16, 2026 |
| Linux | libwinpr-devel almalinux 8 | 2:2.11.7-7.el8_10 | [ALSA-2026:8945](https://patchblox.com/security/data/fix/linux/alsa-2026-8945.md) | Apr 20, 2026 |
| Linux | libwinpr-devel almalinux 9 | 2:2.11.7-1.el9_7.6 | [ALSA-2026:8457](https://patchblox.com/security/data/fix/linux/alsa-2026-8457.md) | Apr 16, 2026 |
| Linux | libwinpr-devel amzn 2023 | 2:3.6.3-1.amzn2023.0.10 | [ALAS2023-2026-1549](https://patchblox.com/security/data/fix/linux/alas2023-2026-1549.md) | Apr 13, 2026 |
| Linux | libwinpr-devel ol 10 | 2:3.10.3-5.el10_1.6 | [ELSA-2026-8458](https://patchblox.com/security/data/fix/linux/elsa-2026-8458.md) | Apr 16, 2026 |
| Linux | libwinpr-devel ol 8 | 2:2.11.7-7.el8_10 | [ELSA-2026-8945](https://patchblox.com/security/data/fix/linux/elsa-2026-8945.md) | Apr 20, 2026 |
| Linux | libwinpr-devel ol 9 | 2:2.11.7-1.el9_7.6 | [ELSA-2026-8457](https://patchblox.com/security/data/fix/linux/elsa-2026-8457.md) | Apr 16, 2026 |
| Linux | libwinpr-tools3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libwinpr-tools3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwinpr-tools3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | libwinpr3-3 Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [libwinpr3-3 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwinpr3-3-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |
| Linux | winpr3-utils Ubuntu 24.04.5 LTS (noble) | 3.30.0+dfsg-0ubuntu0.24.04.1 | [winpr3-utils 3.30.0+dfsg-0ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-winpr3-utils-3.30.0-dfsg-0ubuntu0.24.04.1.md) | Jul 23, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.