Junglewise Threat Intelligence

CVE-2026-23533: FreeRDP heap buffer overflow in ClearCodec decode path

CVE-2026-23533 · Severity: critical · CVSS 9.8 · Published 2026-01-19

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A security flaw allows a malicious server to attack a user's computer when they attempt to connect. This could result in the application crashing or, in more severe cases, allow the attacker to run unauthorized code on the user's system.

Technical details

A heap-based buffer overflow exists in FreeRDP's ClearCodec implementation within the `clear_decompress_residual_data` function. The vulnerability is rooted in `clear_resize_buffer`, where an integer overflow during size calculation leads to an undersized memory allocation. When processing `WIRE_TO_SURFACE_PDU_1` messages, a malicious server can provide crafted width, height, and residual data to trigger out-of-bounds writes. This can lead to a denial of service (crash) or potential remote code execution on the client machine. The issue is fixed in version 3.21.0.

Affected products

  • FreeRDP FreeRDP < 3.21.0
  • Red Hat Enterprise Linux 7, 8, 9, 10

Timeline

  • 2026-01-19: disclosed
  • 2026-01-19: patched: Fixed in version 3.21.0
  • 2026-02-05: advisory: Red Hat security advisory issued

References

Related threats