CVE-2026-22853 — Out-of-bounds Write in Freerdp

CWE-787 — Out-of-bounds Write6 documents6 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 74.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FreerdpDebian Freerdp2Debian Freerdp3
Timeline
PublishedJan 14
Latest updateMar 18

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDfreerdp/freerdp< 3.20.1
▶debiandebian/freerdp2< freerdp3 3.20.2+dfsg-1 (forky)
▶debiandebian/freerdp3< freerdp3 3.20.2+dfsg-1 (forky)

🔴Vulnerability Details

1
OSV
CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol↗2026-01-14
▶

📋Vendor Advisories

3
Ubuntu
FreeRDP vulnerabilities↗2026-03-18
▶
Red Hat
freerdp: FreeRDP heap-buffer-overflow↗2026-01-14
▶
Debian
CVE-2026-22853: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-22853 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-22853 — Out-of-bounds Write in Freerdp | cvebase