Threats Tagged 'cve-2026-22853'

Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP) used by the xfreerdp client. These include heap-buffer overflows, global-buffer overflows, heap-use-after-free, NULL pointer dereferences, and denial of service conditions. Some of these vulnerabilities allow for arbitrary code execution via crafted RDP server messages or pixel data. The issues affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products. Red Hat has issued an important security advisory with updates to address these vulnerabilities.

Multiple heap and global buffer overflow vulnerabilities and a use-after-free denial of service issue have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol. These vulnerabilities affect the xfreerdp client used to connect to various RDP servers. The issues have been addressed in an update available for Red Hat Enterprise Linux 10.0 Extended Update Support. The vulnerabilities are rated as having an important security impact by Red Hat.

FreeRDP versions prior to 3.20.1 contain a heap buffer overflow vulnerability in the RDPEAR NDR array reader due to lack of bounds checking on the on-wire element count. This flaw allows writing past the allocated heap buffer in the ndr_read_uint8Array function. The vulnerability has a high CVSS score of 9.8 and affects multiple Red Hat Enterprise Linux and Ubuntu package versions. It is fixed in FreeRDP version 3.20.1 and later. No known exploits in the wild have been reported. System updates from Red Hat and Ubuntu provide patches to remediate this issue.