CVE-2026-22853
FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.
| CWE | CWE-787 |
| Vendor | freerdp |
| Product | freerdp |
| Published | Jan 14, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for freerdp freerdp
Be the first to know when new high vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreeRDP / FreeRDP
< 3.20.1
References
github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch github.com: https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-22853 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2429647 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22853.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4121 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3068 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19033