Analysis
AI-assisted
CVE-2026-22854: FreeRDP Heap-Based Buffer Overflow in Drive Read Path
FreeRDP, a free implementation of the Remote Desktop Protocol, contains a heap-based buffer overflow in its drive read handling (drive_process_irp_read) before version 3.20.1. A server-controlled read length is used without a hard upper bound, so an oversized read can overwrite heap memory. The issue is fixed in 3.20.1, and the record shows no confirmed exploitation in the sources consulted.
Overview The CVE record describes a heap-based buffer overflow in FreeRDP drive read handling, identified in the record as drive_process_irp_read. The weakness is classified as CWE-122 (Heap-based Buffer Overflow). The record states that a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound. ## Impact The record states that an oversized read can overwrite heap memory. The available data does not describe the exact memory corruption outcome, such as whether code execution is possible. NVD assigns a CVSS score of 9.8 (critical). Another provider in the record assigns a lower score of 6.8. The SSVC data in the record lists exploitation as none, automatable as no, and technical impact as total. ## Affected products and versions The record lists FreeRDP (product string Freerdp Freerdp) as affected before 3.20.1. The fixed version is 3.20.1. ## Exploitation status The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded. No confirmed exploitation appears in the sources consulted. One reference is tagged as Exploit in the record, but that tag alone does not confirm exploitation, and the referenced content was not reviewed for this analysis. EPSS gives a probability of 0.00531 with a percentile of 0.44087. ## Remediation and mitigation Upgrade FreeRDP to 3.20.1 or later, as stated in the project release notes and the GitHub security advisory. Where immediate upgrade is not possible, limit exposure of RDP services to trusted networks and restrict drive redirection to trusted servers and users, as a general defensive measure. Verify that packaged builds and embedded clients that bundle FreeRDP are also updated. ## Detection guidance Inventory systems and applications that embed FreeRDP and record their versions. Monitor RDP clients for abnormal crashes or memory faults during file redirection operations. Review logs for unusual drive redirection activity from unexpected servers. ## Limitations of the available information The record does not provide a detailed technical root-cause analysis, a proof-of-concept or a complete list of distribution-specific builds. The referenced GitHub advisory and release page were not reviewed in full for this analysis. Exploitability conditions beyond the server-controlled read length are unknown.
Frequently asked questions
Which FreeRDP versions are affected by CVE-2026-22854?
The record lists FreeRDP versions before 3.20.1 as affected. Version 3.20.1 contains the fix.
Is this CVE known to be actively exploited?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.