Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26955 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients… https://www.cve.org/CVERecord?id=CVE-2026-26955
Post summary
The post announces a heap buffer overflow vulnerability in FreeRDP clients (prior to v3.23.0) that can be triggered by a malicious RDP server, without mentioning PoC, exploit code, or patch details.
CVE-2026-26955 pertains to a heap buffer overflow vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). Specifically, prior to version 3.23.0, a malicious RDP server can exploit this flaw by sending crafted RDPGFX ClearCodec surface commands with out-of-bounds destination rectangles. This results in a heap buffer overflow within the client, which can be exploited to achieve arbitrary code execution. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution #BufferOverflow https://cvetodo.com/cve/CVE-2026-26955
Post summary
The post discloses a heap buffer overflow in FreeRDP that can lead to arbitrary code execution via crafted RDPGFX ClearCodec commands, but it does not mention a PoC, exploit, patch, or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freerdp | freerdp | - | - | - |