CVE-2026-22854

Critical

Published: 14/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

FreeRDP before version 3.20.1 contains a heap-buffer-overflow vulnerability in drive read. A server-controlled read length is used without a hard upper bound, allowing an oversized read to overwrite heap memory.

Risk Assessment

A malicious RDP server could exploit this vulnerability to corrupt client memory, potentially leading to a crash or arbitrary code execution.

Recommendation

Upgrade FreeRDP to version 3.20.1 or later, which includes a fix that bounds the read length.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This vulnerability is fixed in 3.20.1.