CVE-2026-23531
Published: 19 January 2026
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server…
more
can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and patching of flaws like the heap buffer overflow in FreeRDP's ClearCodec to prevent exploitation via crafted RDPGFX updates.
Implements memory protection mechanisms such as address space layout randomization and heap isolation to mitigate heap corruption and code execution risks from out-of-bounds reads/writes.
Mandates validation of protocol inputs like destination rectangles in RDP surface updates to prevent heap-based buffer overflows from invalid data.
Security SummaryAI
CVE-2026-23531 is a heap buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.21.0. The issue resides in the ClearCodec component, where the `clear_decompress` function calls `freerdp_image_copy_no_overlap` without validating the destination rectangle when `glyphData` is present. This flaw enables out-of-bounds read/write operations through crafted RDPGFX surface updates, classified under CWE-122 (Heap-based Buffer Overflow) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A malicious RDP server can exploit this vulnerability against connecting FreeRDP clients over the network with no privileges or user interaction required. Successful exploitation triggers a client-side heap buffer overflow, reliably causing a denial-of-service via application crash, and potentially leading to heap corruption with code execution risk contingent on the memory allocator's behavior and surrounding heap layout.
The FreeRDP security advisory (GHSA-xj5h-9cr5-23c5) and release notes for version 3.21.0 detail the patch, which addresses the validation issue in `clear.c` at lines 1139-1145. Security practitioners should update affected FreeRDP clients to version 3.21.0 or later to mitigate the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in FreeRDP client exploitable remotely by malicious RDP server via crafted RDPGFX updates, enabling code execution or DoS on client systems, directly mapping to Exploitation for Client Execution (T1203).