CVE-2026-22852

Critical

Published: 14/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

FreeRDP before version 3.20.1 contains a heap-buffer-overflow write vulnerability when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple PDUs and writes past the newly allocated array, causing memory corruption and a crash.

Risk Assessment

A malicious RDP server could send specially crafted PDUs to crash the client or potentially execute code, posing a serious security threat.

Recommendation

Upgrade FreeRDP to version 3.20.1 or later, which fixes the reuse of the counter.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and writes past the newly allocated formats array, causing memory corruption and a crash. This vulnerability is fixed in 3.20.1.