Junglewise Threat Intelligence

CVE-2026-23531: FreeRDP heap buffer overflow in ClearCodec

CVE-2026-23531 · Severity: critical · CVSS 9.8 · Published 2026-01-19

Technologies: FreeRDP. Vendors: FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A vulnerability in how it handles certain image data allows a malicious server to crash the user's connection software or potentially take control of the user's computer. This could lead to a loss of service or the unauthorized access of sensitive data on the machine running the FreeRDP client.

Technical details

A heap-based buffer overflow exists in FreeRDP's ClearCodec implementation within the `clear_decompress` function. When `glyphData` is present, the function calls `freerdp_image_copy_no_overlap` using destination rectangle coordinates (`destRect`) provided by the server without validating them against the target surface dimensions. An attacker controlling a malicious RDP server can send crafted RDPGFX surface updates with out-of-bounds coordinates to trigger an out-of-bounds read or write. This can result in a client-side crash (DoS) or heap corruption, potentially leading to arbitrary code execution. The issue is fixed in version 3.21.0 by implementing proper bounds checking for destination rectangles.

Affected products

  • FreeRDP FreeRDP < 3.21.0

Timeline

  • 2026-01-19: advisory: GitHub Security Advisory GHSA-xj5h-9cr5-23c5 published
  • 2026-01-19: patched: Version 3.21.0 released with fixes

References

Related threats