AIKIDO-2026-777376

TL;DR

The glyph cache update handler processes a GLYPH_FRAGMENT_ADD order by reading a one-byte declared fragment size from server-controlled data without checking that the declared size fits in the received buffer. The cache store then allocates and copies that many bytes from the fragment pointer, reading past the end of a short allocation. A malicious RDP server can cause a client-side heap out-of-bounds read and crash. The fix validates the declared fragment size against the remaining buffer before copying.