freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmapcacheput. A malicious server can send a CACHEBITMAPORDER Rev1 with cacheId equal to maxCells,...

CVE-2026-29775

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmapcacheput. A malicious server can send a CACHEBITMAPORDER Rev1 with cacheId equal to maxCells,...

CVE-2026-29775

The CVE-2026-29775 issue affects FreeRDP’s bitmap cache subsystem. A client-side heap out-of-bounds read/write occurs due to an off-by-one boundary check in bitmap_cache_put, allowing a malicious server to send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells and access cells[] one elem...