CVE-2026-22855: FreeRDP smartcard SetAttrib out-of-bounds read

Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. According to the GitHub Security Advisory, FreeRDP versions before 3.20.1 have an out-of-bounds read in the smartcard SetAttrib handling. The flaw occurs when the attribute length field does not agree with the length of the NDR buffer that carries the data. The record states that the fix is included in 3.20.1.

Impact

The record classifies the weakness as CWE-125 (out-of-bounds read), which can lead to exposure of adjacent heap memory or to a crash of the affected process.
NVD lists a base score of 9.1 (critical). GitHub's CNA lists 5.6 under a different CVSS generation. The two scores differ, so consumers should read the vector and rationale in each source.
SSVC data in the record reports technical impact as partial and automatable as no.

Affected products and versions

Product: FreeRDP (FreeRDP project).
Affected range as recorded: before 3.20.1.
Fixed version as recorded: 3.20.1.
The record's fixes list is empty. The fixed version is taken from the description, the affected range and the release reference, not from a structured fixes field.

Exploitation status

The record shows the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as proof-of-concept, which describes the availability of public technical material and not confirmed attacks. Defenders should not treat this as evidence of active exploitation, and should also not assume none will occur.

Remediation and mitigation

Upgrade FreeRDP to 3.20.1 or later, using the release notes linked from the GitHub release page.
Check whether your Linux distribution or appliance vendor has shipped a backported package. Several Red Hat errata reference this CVE, and their package-level details should be read directly from those advisories.
Where patching is delayed, reduce exposure of RDP services to untrusted networks and restrict smartcard redirection to systems that need it. These are general hardening steps and do not replace the upgrade.

Detection guidance

Build an inventory of FreeRDP builds and embedded copies, including those bundled in third-party software, and compare them against the 3.20.1 boundary.
Review RDP gateway and host logs for crashes or service restarts in processes that handle smartcard redirection, as these may indicate memory-safety faults.
Track vendor advisories for updates, since the record does not provide detection signatures.

Limitations of the available information

The title in the source data calls the issue a heap-buffer-overflow, while the description and CWE classify it as an out-of-bounds read. This analysis follows the description and CWE.
The record does not state whether the flaw is reachable before authentication or in every configuration, so this is unknown.
The fixes field is empty and no commit identifier is provided in the record.
EPSS values are present, but they estimate exploitation likelihood and do not confirm activity.

Frequently asked questions

Which FreeRDP versions are affected by CVE-2026-22855?

The record lists the affected range as versions before 3.20.1. Check your builds and embedded copies against that boundary.

Is this CVE known to be exploited in the wild?

It is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. The SSVC field notes proof-of-concept availability only.

What should administrators do first?

Plan an upgrade to 3.20.1 or a vendor-backported package, and reduce RDP exposure to untrusted networks while the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.