Skip to main content

FreeRDP CVE-2026-23530

HIGH
Heap-based Buffer Overflow (CWE-122)
2026-01-19 security-advisories@github.com
Buffer Overflow Freerdp Heap Overflow
7.7
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Server-to-client attack needs the victim to connect (UI:R); no auth on the malicious path (PR:N); confirmed impact is a client crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.6 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

11
Analysis Updated
Jun 30, 2026 - 06:09 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:09 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:09 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 06:08 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:23 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
CRITICAL HIGH
CVSS changed
Jun 30, 2026 - 03:23 NVD
9.8 (CRITICAL) 7.7 (HIGH)
Patch released
Apr 09, 2026 - 20:30 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Jan 28, 2026 - 18:53 vuln.today
Public exploit code
CVE Published
Jan 19, 2026 - 17:15 nvd
CRITICAL 9.8

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,freerdp_bitmap_decompress_planar does not validate nSrcWidth/nSrcHeight against planar->maxWidth/maxHeight before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

AnalysisAI

Client-side heap buffer overflow in FreeRDP before version 3.21.0 lets a malicious or compromised RDP server crash connecting clients and potentially corrupt heap memory. The flaw lives in the planar codec's freerdp_bitmap_decompress_planar, which fails to bound-check decoded bitmap dimensions before RLE decompression, yielding a denial-of-service with a speculative code-execution path. Publicly available exploit code exists via the GitHub Security Advisory, though EPSS exploitation probability remains low (0.15%) and it is not on CISA KEV.

Technical ContextAI

FreeRDP is a widely used open-source implementation of the Remote Desktop Protocol (RDP). The bug is a CWE-122 heap-based buffer overflow in the planar (RDP6) bitmap codec at libfreerdp/codec/planar.c. During freerdp_bitmap_decompress_planar, the server-supplied nSrcWidth/nSrcHeight values are not validated against the codec context's allocated planar->maxWidth/maxHeight limits before the RLE decode loop writes pixel data, so an oversized declared bitmap drives writes past the bounds of the heap buffer sized for the maximum dimensions. The affected component is the RDP client decoder, meaning the trust boundary crossed is server-to-client: the server is the untrusted party feeding malformed graphics updates.

RemediationAI

Vendor-released patch: FreeRDP 3.21.0 - upgrade all FreeRDP-based clients to 3.21.0 or later (see https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0 and advisory https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p). For Red Hat-based systems, apply the corresponding errata (e.g., RHSA-2026:2081 / RHSA-2026:3041 at https://access.redhat.com/errata/RHSA-2026:2081) and restart affected client applications. Where immediate patching is not possible, the practical compensating control is to restrict outbound RDP: only connect to known-trusted RDP servers and block or proxy outbound TCP/3389 (and RDP-over-gateway endpoints) to untrusted hosts, accepting the trade-off that this breaks ad-hoc connections to new servers. Because exploitation requires the client to connect to a malicious server, enforcing server allow-lists and avoiding connections initiated from untrusted links (emails, documents containing .rdp files) meaningfully reduces exposure until the upgrade is deployed.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.43 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.67 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.57 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.64 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Liberty Linux 8 Fixed

Share

CVE-2026-23530 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy