FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array_CVE-2026-22853

6.8 / 10

MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

Basic Information

ID CVE-2026-22853

Source GitHub_M

Published Jan 14, 2026 at 17:46

Affected Product

Vendor FreeRDP

Product FreeRDP

Version < 3.20.1

Affected Versions FreeRDP FreeRDP < 3.20.1

CWE Classification

CWE-787

References

{
    "lastseen": "",
    "description": "FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR\u2019s NDR array reader does not perform bounds checking on the on\u2011wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.",
    "published": "2026-01-14T17:46:50.159Z",
    "modified": "2026-01-14T17:46:50.159Z",
    "type": "cve",
    "title": "FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array",
    "source": "GitHub_M",
    "references": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch\nhttps://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1",
    "id": "CVE-2026-22853",
    "bulletinFamily": "",
    "cwe": [
        "CWE-787"
    ],
    "cvelist": null,
    "sourceData": "FreeRDP FreeRDP < 3.20.1",
    "sourceHref": "",
    "cvss": {
        "score": 6.8,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "FreeRDP",
    "version": "< 3.20.1",
    "vendor": "FreeRDP",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}