Junglewise Threat Intelligence

CVE-2026-22859: FreeRDP out-of-bounds read in URBDRC client

CVE-2026-22859 · Severity: critical · CVSS 9.1 · Published 2026-01-14

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A vulnerability in its USB redirection feature allows a malicious server to trigger a crash or read sensitive memory on a user's computer when they connect. This could lead to a denial of service or the exposure of private information from the user's session.

Technical details

An out-of-bounds read vulnerability exists in FreeRDP's URBDRC (USB Redirection) client. The root cause is a lack of bounds checking on server-supplied MSUSB_INTERFACE_DESCRIPTOR values, specifically 'InterfaceNumber' and 'AlternateSetting'. These untrusted values are used as array indices within the 'libusb_udev_complete_msconfig_setup' function. An attacker controlling a malicious RDP server can send a crafted TS_URB_SELECT_CONFIGURATION packet to trigger the OOB read. This can result in a heap-buffer-overflow, leading to a crash (DoS) or potential information disclosure. The issue is fixed in version 3.20.1.

Affected products

  • FreeRDP FreeRDP < 3.20.1
  • Red Hat Enterprise Linux 7, 8, 10

Timeline

  • 2026-01-14: patched: Fixed in FreeRDP version 3.20.1
  • 2026-01-14: disclosed: GitHub Security Advisory published
  • 2026-05-19: advisory: Red Hat security advisory RHSA-2026:19033 published

References

Related threats