FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfree…

FreeRDP versions 3.28.0 and earlier contain a heap out-of-bounds read vulnerability in the update_process_glyph_fragments() and glyph_cache_fragment_put() functions within libfreerdp/cache/glyph.c. The flaw arises when handling a GLYPH_FRAGMENT_ADD update, where the code reads a server-controlled one-byte declared fragment size without validating it against the remaining buffer length. A malicious RDP server can exploit this by sending a short fragment with an inflated declared size, causing the client to read beyond the allocated heap buffer. The result is an out-of-bounds read that leads to a client crash. The vulnerability is fixed in FreeRDP 3.29.0. A patch is available via the official FreeRDP GitHub repository. The issue has also been documented in a GitHub Security Advisory (GHSA-hgj8-g595-wfc6) and tracked by VulnCheck.