Junglewise Threat Intelligence

CVE-2026-22858: FreeRDP global buffer overflow in Base64 decoding

CVE-2026-22858 · Severity: critical · CVSS 9.1 · Published 2026-01-14

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol (RDP). A security flaw in how it handles data encoding on certain hardware (specifically ARM-based systems) could allow an attacker to crash the application or potentially access sensitive memory. This affects users connecting to remote servers and organizations using FreeRDP proxy services.

Technical details

A global-buffer-overflow exists in FreeRDP's Base64 decoding path due to implementation-defined char signedness on ARM/AArch64 architectures. In these environments, 'char' is treated as unsigned by default, causing the compiler to optimize the guard 'c <= 0' into a simple 'c != 0' check. Consequently, non-ASCII bytes (0x80-0xFF) bypass range restrictions and are used as indices into a global lookup table, leading to out-of-bounds reads or writes. The vulnerability primarily affects FreeRDP-based clients and proxies when processing malicious RDP traffic. This issue is resolved in version 3.20.1 by enforcing proper length and signedness checks.

Affected products

  • FreeRDP FreeRDP < 3.20.1
  • Red Hat Enterprise Linux 7, 8, 10

Timeline

  • 2026-01-14: disclosed
  • 2026-01-14: patched: Fixed in version 3.20.1
  • 2026-01-14: advisory

References

Related threats