Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-33983
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-30 Mar, 2026 | 21:42
Updated At-15 Jul, 2026 | 01:05
Rejected At-
â–¼CVE Numbering Authority (CNA)
FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_upgrade() detects a mismatch via progressive_rfx_quant_cmp_equal() but only emits WLog_WARN, execution continues. The wrapped value (247) is used as a shift exponent, causing undefined behavior and an approximately 80 billion iteration loop (CPU DoS). This issue has been patched in version 3.24.2.

Affected Products
Vendor
FreeRDPFreeRDP
Product
FreeRDP
Versions
Affected
  • < 3.24.2
Problem Types
TypeCWE IDDescription
CWECWE-190CWE-190: Integer Overflow or Wraparound
CWECWE-252CWE-252: Unchecked Return Value
Type: CWE
CWE ID: CWE-190
Description: CWE-190: Integer Overflow or Wraparound
Type: CWE
CWE ID: CWE-252
Description: CWE-252: Unchecked Return Value
Metrics
VersionBase scoreBase severityVector
3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
Resource:
x_refsource_MISC
â–¼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A remote attacker could exploit this vulnerability by sending a specially crafted RDP message. This can lead to an undefined behavior where a wrapped value is used as a shift exponent, causing an approximately 80 billion iteration loop. This results in a Denial of Service (DoS) due to excessive CPU utilization.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:10.1
  • cpe:/o:redhat:enterprise_linux:10.2
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-12.el10_2.2 before * (rpm)
  • From 2:3.10.3-5.el10_1.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10.0 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux_eus:10.0
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-3.el10_0.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:8
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-7.el8_10 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.2 Advanced Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.2
Default Status
affected
Versions
Unaffected
  • From 2:2.0.0-46.rc4.el8_2.11 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.4
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-13.el8_4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus_long_life:8.4
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-13.el8_4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_tus:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_tus:8.8
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-12.el8_8.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:8.8
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-12.el8_8.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:9
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_7.6 before * (rpm)
  • From 2:2.11.7-7.el9_8.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.0
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-3.el9_0.5 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.2
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-6.el9_2.7 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.4 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.4
Default Status
affected
Versions
Unaffected
  • From 2:2.11.2-1.el9_4.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.6 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.6
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_6.8 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 6
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:6
Default Status
unknown
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:7
Default Status
unknown
Problem Types
TypeCWE IDDescription
CWECWE-190Integer Overflow or Wraparound
Type: CWE
CWE ID: CWE-190
Description: Integer Overflow or Wraparound
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:11333: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)

RHSA-2026:8458: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

RHSA-2026:19033: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

RHSA-2026:8945: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)

RHSA-2026:11651: Red Hat Enterprise Linux AppStream AUS (v. 8.2)

RHSA-2026:11649: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)

RHSA-2026:12388: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)

RHSA-2026:12359: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)

RHSA-2026:11332: Red Hat Enterprise Linux AppStream E4S (v.9.0)

RHSA-2026:11336: Red Hat Enterprise Linux AppStream E4S (v.9.2)

RHSA-2026:10709: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)

RHSA-2026:9656: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)

RHSA-2026:8457: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

RHSA-2026:19349: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Configurations
Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Exploits
Credits
Timeline
EventDate
Reported to Red Hat.2026-03-30 22:01:29
Made public.2026-03-30 21:42:27
Event: Reported to Red Hat.
Date: 2026-03-30 22:01:29
Event: Made public.
Date: 2026-03-30 21:42:27
Replaced By
Rejected Reason
References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-33983
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2453220
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33983.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:11333
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8458
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19033
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8945
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11651
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11649
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12388
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:12359
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11332
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11336
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10709
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9656
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8457
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19349
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-33983
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2453220
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33983.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:11333
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:8458
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:19033
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:8945
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:11651
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:11649
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:12388
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:12359
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:11332
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:11336
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:10709
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:9656
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:8457
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:19349
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found