CVE Intelligence
Analysis AI-assisted

CVE-2026-22853: FreeRDP heap buffer overflow in ndr_read_uint8Array

CVE-2026-22853 is a heap buffer overflow in FreeRDP's ndr_read_uint8Array function, caused by missing bounds checks on an element count read from the network. FreeRDP versions before 3.20.1 are affected, and the record states the issue is fixed in 3.20.1. The record does not list it in CISA KEV, although the SSVC data marks the exploitation level as proof-of-concept.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. CVE-2026-22853 affects the NDR array reader used by RDPEAR. According to the record, the reader does not check the element count received from the network before writing, so data can be written past a heap buffer allocated from hints. The weakness is reported in the function ndr_read_uint8Array and is classified as CWE-787 (out-of-bounds write).

Impact

  • NVD assigns a CVSS base score of 9.8 and a critical severity rating, which the record marks as confirmed from NVD.
  • The record's CVSS impact metrics describe high confidentiality, integrity and availability impact.
  • GitHub and another provider in the record assign a lower score of 6.8 under a different CVSS version.
  • The SSVC data in the record lists technical impact as total.

Affected products and versions

  • Product: FreeRDP (listed in the record as Freerdp Freerdp).
  • Affected: versions before 3.20.1.
  • Fixed in: 3.20.1, according to the description and the FreeRDP 3.20.1 release.
  • The structured fixes field in the record is empty, so the fixed version is taken from the description and release reference rather than from that field.

Exploitation status

  • The record shows the CISA KEV listed field as false. No confirmed active exploitation appears in the sources consulted.
  • The SSVC data lists the exploitation level as proof-of-concept and automatable as no.
  • The EPSS probability in the record is 0.00777 with a percentile of 0.55379, dated 2026-10-23.
  • One reference in the record is tagged as an exploit reference, but the record does not describe its contents.

Remediation and mitigation

  • Update FreeRDP to version 3.20.1 or later, as described in the GitHub security advisory.
  • Inventory where FreeRDP is used, including builds bundled inside third-party products, and confirm with each vendor whether their build includes the fix.
  • Limit exposure of RDP services to trusted networks and apply the principle of least privilege to remote access.
  • Track vendor and distribution advisories, which may ship the fix on their own schedules.

Detection guidance

  • Monitor systems running FreeRDP for unexpected crashes or restarts of RDP-related services, which can indicate memory corruption.
  • Review logs for RDP connections from unexpected or untrusted sources.
  • Keep endpoint and host monitoring enabled on systems that expose RDP functionality.

Limitations of the available information

  • The record does not include a detailed root-cause analysis or the conditions needed to trigger the overflow in practice.
  • The record does not state which FreeRDP builds or configurations enable the RDPEAR component.
  • The record's structured fixes field is empty, so the fixed version relies on the description and release reference.
  • Exploitation data is limited to the KEV, SSVC and EPSS fields in the record.

Frequently asked questions

Which FreeRDP versions are affected by CVE-2026-22853?

The record lists versions before 3.20.1 as affected. The description states the issue is fixed in 3.20.1.

Is CVE-2026-22853 known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. SSVC data lists the exploitation level as proof-of-concept.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.