CVE-2026-23532
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In FreeRDP prior to version 3.21.0, a client-side heap buffer overflow exists in the `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. This can cause a crash and potential heap corruption with code-execution risk.
Risk Assessment
A malicious RDP server can trigger a client-side heap buffer overflow, leading to a denial of service (DoS) and potential remote code execution depending on the allocator and heap layout.
Recommendation
Upgrade FreeRDP to version 3.21.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.