QwikSec

Security Database

CVE

CWE

Training

CVE-2026-22853

Published: Jan 14, 2026

Modified: Feb 26, 2026

PUBLISHED

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

Vendor	Product	Versions
FreeRDP	FreeRDP	affected `< 3.20.1`

Weaknesses (CWE)

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch

x_refsource_CONFIRM

https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.