What is the CVSS score of CVE-2026-25941?

CVE-2026-25941 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Freerdp are affected by CVE-2026-25941?

Organizations using FreeRDP should be aware of moderate risk from CVE-2026-25941, a input validation vulnerability rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25941?

Yes, a public proof-of-concept exploit is available for CVE-2026-25941. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25941?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Freerdp CVE-2026-25941

MEDIUM

Improper Input Validation (CWE-20)

2026-02-25 security-advisories@github.com

Denial Of Service Information Disclosure Freerdp Red Hat Suse

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 14:53 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 14:53 nvd

Patch available

CVE Published

Feb 25, 2026 - 20:23 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a bitmapDataLength value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.

AnalysisAI

FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 4.3 MEDIUM]

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Freerdp. FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a bitmapDataLength value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed

CVE-2026-25941 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security	Fixed
SUSE Linux Enterprise Server 15 SP4	Fixed
SUSE Linux Enterprise Server 15 SP5	Fixed
SUSE Linux Enterprise Server 15 SP6	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Desktop 12 SP2	Fixed
SUSE Linux Enterprise Desktop 12 SP3	Fixed
SUSE Linux Enterprise Desktop 12 SP4	Fixed
SUSE Linux Enterprise Desktop 15 SP4	Fixed
SUSE Linux Enterprise Desktop 15 SP5	Fixed
SUSE Linux Enterprise Desktop 15 SP6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP4	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Server 12 SP2	Fixed
SUSE Linux Enterprise Server 12 SP3	Fixed
SUSE Linux Enterprise Server 12 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP2	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP3	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP4	Fixed
SUSE Linux Enterprise Software Development Kit 12 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP2	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP3	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP4	Fixed
SUSE Linux Enterprise Workstation Extension 12 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP4	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP5	Fixed
SUSE Linux Enterprise Workstation Extension 15 SP6	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Freerdp CVE-2026-25941

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Freerdp

Same weakness CWE-20 – Improper Input Validation

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code