Log in Start free

Vulnerability · Published Jan 14, 2026 · Assigned by GitHub_M

CVE-2026-22854FreeRDP has a heap-buffer-overflow in drive_process_irp_read

Medium 6.8

In plain English

A medium-severity heap buffer overflow in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. This vulnerability is fixed in 3.20.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-devel2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp-devel2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp-devel2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-libs2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp-libs2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp-libs2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-server2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:10libwinpr2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8libwinpr2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9libwinpr2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10libwinpr-devel2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8libwinpr-devel2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9libwinpr-devel2:2.11.7-1.el9_7.5ALSA-2026:6340
Alpine:v3.23freerdp3.22.0-r0ALPINE-CVE-2026-22854
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-22854
Debian:13freerdp33.15.0+dfsg-2.1+deb13u1DEBIAN-CVE-2026-22854
Debian:14freerdp33.20.2+dfsg-1DEBIAN-CVE-2026-22854
Rocky Linux:10freerdp2:3.10.3-5.el10_1.5RLSA-2026:6799
Rocky Linux:8freerdp2:2.11.7-6.el8_10RLSA-2026:6918
Rocky Linux:9freerdp2:2.11.7-1.el9_7.5RLSA-2026:6340
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-22854
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.4USN-8105-1
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.4UBUNTU-CVE-2026-22854
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3USN-8105-1
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3UBUNTU-CVE-2026-22854
Ubuntu:26.04:LTSfreerdp33.20.2+dfsg-1UBUNTU-CVE-2026-22854

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.20.1

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References