Is CVE-2026-23533 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23533 being exploited in the wild.

How severe is CVE-2026-23533?

Critical severity, with a CVSS score of 9.8, published 19 January 2026.

Is there a fix for CVE-2026-23533?

A patch was published on 2026-01-19: Fixed in version 3.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23533 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23533?

Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23533: FreeRDP heap buffer overflow in ClearCodec decode path

CVE-2026-23533 · Severity: critical · CVSS 9.8 · Published 2026-01-19

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A security flaw allows a malicious server to attack a user's computer when they attempt to connect. This could result in the application crashing or, in more severe cases, allow the attacker to run unauthorized code on the user's system.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-23533 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23533 being exploited in the wild.
How severe is CVE-2026-23533?: Critical severity, with a CVSS score of 9.8, published 19 January 2026.
Which products and versions are affected?: FreeRDP < 3.21.0.
Is there a fix for CVE-2026-23533?: A patch was published on 2026-01-19: Fixed in version 3.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23533 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23533?: Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in FreeRDP's ClearCodec implementation within the `clear_decompress_residual_data` function. The vulnerability is rooted in `clear_resize_buffer`, where an integer overflow during size calculation leads to an undersized memory allocation. When processing `WIRE_TO_SURFACE_PDU_1` messages, a malicious server can provide crafted width, height, and residual data to trigger out-of-bounds writes. This can lead to a denial of service (crash) or potential remote code execution on the client machine. The issue is fixed in version 3.21.0.

Affected products

FreeRDP FreeRDP < 3.21.0
Red Hat Enterprise Linux 7, 8, 9, 10

Timeline

2026-01-19: disclosed
2026-01-19: patched: Fixed in version 3.21.0
2026-02-05: advisory: Red Hat security advisory issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.