VulnSocial

CVE-2026-44421PoC(freerdp / freerdp)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Prioritize remediation for freerdp freerdp systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.

freerdp CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-122CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • freerdp

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-07-22)
  • 3 total mentions across 2 days

Affected systems

Vendors
freerdp
Products
freerdp

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-30: 1Mentions · 2026-07-22: 2PoC Mentioned / Linked · 2026-07-22: 2Exploit Tool / Code · 2026-07-22: 1Technical Details · 2026-05-30: 1Technical Details · 2026-07-22: 205-3007-22
Signal classification2 categories
PoC
266.7%
General
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-301
General1
2026-07-222
PoC2
Full discourse3 posts
  • Daily CyberSecurity@Daily_CyberSec
    PoC

    FreeRDP heap buffer overflow allows remote code execution. PoC exploits are publicly disclosed. Related to CVE-2026-44421, CVE-2026-44422, CVE-2026-40033. #FreeRDP #HeapBufferOverflow #CVE202644421 #CyberSecurity http://securityonline.info/cve-2026-44421-freerdp-heap-buffer-overflow-poc/

    Post summary

    The post announces a heap buffer overflow in FreeRDP that enables remote code execution, with publicly disclosed PoCs linked; no evidence of active exploitation or patch availability is provided.

    090282897
    12.9K followersView on X
  • moton@moton
    PoC

    CVE-2026-44421 RCE PoC: FreeRDP Heap Buffer Overflow - https://securityonline.info/cve-2026-44421-freerdp-heap-buffer-overflow-poc/

    Post summary

    The post announces an RCE Proof of Concept for CVE-2026-44421, detailing a FreeRDP heap buffer overflow and providing a link to the PoC code.

    00010110
    671 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-44421 Heap Buffer Overflow in FreeRDP Client RDPGFX Prior to 3.26.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44421 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    Alert for CVE-2026-44421, a heap buffer overflow in FreeRDP client before version 3.26.0, with no exploitation evidence or patch info provided.

    0000059
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfreerdpfreerdp---

Explore more

Back to dashboardfreerdp CVEsfreerdp vulnerabilities