CVE-2026-22858: FreeRDP Base64 Decoding Global Buffer Overflow
FreeRDP versions before 3.20.1 contain a global buffer overflow in the Base64 decoding path. The record ties the issue to char signedness on Arm and AArch64 builds, where non-ASCII byte values may bypass an intended range check. NVD assigns a CVSS base score of 9.1, and the record does not list the vulnerability in CISA KEV.
Overview
FreeRDP is a free implementation of the Remote Desktop Protocol. According to the record, a global buffer overflow was observed in its Base64 decoding path in versions before 3.20.1. The suspected root cause is char signedness on Arm and AArch64 builds, which can make a range check behave differently than intended.
Impact
- The record describes out-of-bounds access when non-ASCII byte values are used as an index into a global lookup table.
- The weakness is classified as CWE-125 (Out-of-bounds Read), while the description refers to a global buffer overflow, so the exact read or write behavior is not fully specified.
- NVD assigns a CVSS base score of 9.1, with network attack vector, no privileges required, no user interaction, and high confidentiality and availability impact in the vector. The GitHub CNA score is 5.6, so providers disagree.
Affected products and versions
- The record lists the product as FreeRDP.
- The affected range is listed as before 3.20.1.
- The description states the issue is fixed in 3.20.1. The structured fixes field in the record is empty, so the fix version comes from the description and the upstream release reference.
- Linux distributions and enterprise products ship their own packages and errata. Check vendor advisories for backport status.
Exploitation status
- The record shows this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
- The SSVC exploitation value in the record is poc, which indicates proof-of-concept status and does not confirm exploitation in the wild.
- One upstream reference is tagged Exploit in the record metadata. Its content was not reviewed for this analysis.
- The EPSS probability is about 0.7 percent.
Remediation and mitigation
- Upgrade FreeRDP to 3.20.1 or later where you build from upstream source.
- For distribution packages, apply the vendor errata. The record references several Red Hat advisories and a CSAF VEX document.
- Until patching is complete, limit network exposure of RDP services to trusted networks.
- Prioritize hosts running Arm or AArch64 builds in your patch plan.
Detection guidance
- Inventory FreeRDP installations across endpoints, servers and embedded devices, and flag Arm and AArch64 platforms.
- Monitor FreeRDP processes for crashes or abnormal terminations, and review RDP logs for unusual connection activity.
- In controlled test environments, memory-safety instrumentation can help validate that a build is free of this defect.
Limitations of the available information
- The record does not include a detailed technical analysis of the exact memory accessed or the full exploit conditions.
- The record does not confirm whether platforms other than Arm and AArch64 are affected.
- Vendor backport status for each distribution is not included in the record.
Frequently asked questions
Is this CVE known to be actively exploited?
The record shows it is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is poc, which indicates proof-of-concept status only.
Which version fixes the issue?
The description states the issue is fixed in 3.20.1, and the upstream release tag for 3.20.1 is referenced in the record.
Does the issue affect only Arm systems?
The description ties the root cause to Arm and AArch64 builds, and the affected range has no platform qualifier. Whether other platforms are affected is unknown from the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.