Log in Start free

Vulnerability · Published Jan 14, 2026 · Assigned by GitHub_M

CVE-2026-22853FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

High 8.1

In plain English

A high-severity out-of-bounds write in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-5.el10_1.2ALSA-2026:3068
AlmaLinux:10freerdp-devel2:3.10.3-5.el10_1.2ALSA-2026:3068
AlmaLinux:10freerdp-libs2:3.10.3-5.el10_1.2ALSA-2026:3068
AlmaLinux:10freerdp-server2:3.10.3-5.el10_1.2ALSA-2026:3068
AlmaLinux:10libwinpr2:3.10.3-5.el10_1.2ALSA-2026:3068
AlmaLinux:10libwinpr-devel2:3.10.3-5.el10_1.2ALSA-2026:3068
Alpine:v3.23freerdp3.22.0-r0ALPINE-CVE-2026-22853
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-22853
Debian:13freerdp33.15.0+dfsg-2.1+deb13u1DEBIAN-CVE-2026-22853
Debian:14freerdp33.20.2+dfsg-1DEBIAN-CVE-2026-22853
Rocky Linux:10freerdp2:3.10.3-5.el10_1.2RLSA-2026:3068
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.4USN-8105-1
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3USN-8105-1
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3UBUNTU-CVE-2026-22853

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.20.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References