p PatchFirst

CVE-2026-22853

CVE-2026-22853 · FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

CVSS 6.8 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • freerdp

    Versions
    • < 3.20.1: Affected

    No fix published

  • freerdp2 Debian:12

    Versions
    • 2.10.0+dfsg1-1
    • 2.10.0+dfsg1-1.1
    • 2.11.2+dfsg1-1
    • 2.11.2+dfsg1-1.1~exp1
    • 2.11.2+dfsg1-1.1~exp2
    • 2.11.5+dfsg1-1
    • 2.11.7+dfsg1-1
    • 2.11.7+dfsg1-2
    • 2.11.7+dfsg1-3
    • 2.11.7+dfsg1-4
    • 2.11.7+dfsg1-5
    • 2.11.7+dfsg1-6
    • 2.11.7+dfsg1-6~deb12u1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freerdp3 Debian:13

    Versions
    • 3.15.0+dfsg-2.1
    Affected ranges
    • ECOSYSTEM: < 3.15.0+dfsg-2.1+deb13u1

    Update to 3.15.0+dfsg-2.1+deb13u1

  • freerdp3 Debian:14

    Versions
    • 3.15.0+dfsg-2.1
    • 3.16.0+dfsg-1
    • 3.16.0+dfsg-2
    • 3.17.0+dfsg-1
    • 3.17.1+dfsg-1
    • 3.17.1+dfsg-2
    • 3.17.2+dfsg-1
    • 3.17.2+dfsg-2
    • 3.17.2+dfsg-3
    • 3.18.0+dfsg-1
    • 3.19.0+dfsg-1
    • 3.19.1+dfsg-1
    • 3.20.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 3.20.2+dfsg-1

    Update to 3.20.2+dfsg-1

  • freerdp3 Ubuntu:25.10

    Versions
    • 3.14.0+dfsg-1ubuntu1
    • 3.15.0+dfsg-2.1
    • 3.16.0+dfsg-1ubuntu1
    • 3.16.0+dfsg-2
    • 3.16.0+dfsg-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.16.0+dfsg-2ubuntu0.3

    Update to 3.16.0+dfsg-2ubuntu0.3

Original sources

Check your server →