Is CVE-2026-23531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23531 being exploited in the wild.

How severe is CVE-2026-23531?

Critical severity, with a CVSS score of 9.8, published 19 January 2026.

Is there a fix for CVE-2026-23531?

A patch was published on 2026-01-19: Version 3.21.0 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23531 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23531?

Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23531: FreeRDP heap buffer overflow in ClearCodec

CVE-2026-23531 · Severity: critical · CVSS 9.8 · Published 2026-01-19

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A vulnerability in how it handles certain image data allows a malicious server to crash the user's connection software or potentially take control of the user's computer. This could lead to a loss of service or the unauthorized access of sensitive data on the machine running the FreeRDP client.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-23531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23531 being exploited in the wild.
How severe is CVE-2026-23531?: Critical severity, with a CVSS score of 9.8, published 19 January 2026.
Which products and versions are affected?: FreeRDP < 3.21.0.
Is there a fix for CVE-2026-23531?: A patch was published on 2026-01-19: Version 3.21.0 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23531 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23531?: Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in FreeRDP's ClearCodec implementation within the `clear_decompress` function. When `glyphData` is present, the function calls `freerdp_image_copy_no_overlap` using destination rectangle coordinates (`destRect`) provided by the server without validating them against the target surface dimensions. An attacker controlling a malicious RDP server can send crafted RDPGFX surface updates with out-of-bounds coordinates to trigger an out-of-bounds read or write. This can result in a client-side crash (DoS) or heap corruption, potentially leading to arbitrary code execution. The issue is fixed in version 3.21.0 by implementing proper bounds checking for destination rectangles.

Affected products

FreeRDP FreeRDP < 3.21.0

Timeline

2026-01-19: advisory: GitHub Security Advisory GHSA-xj5h-9cr5-23c5 published
2026-01-19: patched: Version 3.21.0 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.