CVE-2026-22855

CriticalCVSS 9.1

Published: 14/01/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

51th percentile - higher than 51% of all known CVEs

Summary

In FreeRDP prior to 3.20.1, a heap out-of-bounds read vulnerability exists in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length.

Risk Assessment

An attacker could exploit this vulnerability to read sensitive data from the RDP server memory, potentially leading to information disclosure or service disruption.

Recommendation

Upgrade FreeRDP to version 3.20.1 or later immediately, which includes a fix for this vulnerability.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.