CVE-2026-23534
Published: 19 January 2026
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer.…
more
A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of the heap buffer overflow flaw in FreeRDP by upgrading to the patched version 3.21.0.
Requires validation of untrusted inputs like crafted ClearCodec band coordinates to prevent writes beyond the destination surface buffer.
Implements memory protections such as ASLR and DEP to mitigate heap corruption and potential code execution from the buffer overflow.
Security SummaryAI
CVE-2026-23534 is a client-side heap buffer overflow vulnerability (CWE-122) in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). It affects versions prior to 3.21.0 and occurs in the ClearCodec bands decode path, where crafted band coordinates enable writes beyond the end of the destination surface buffer. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high confidentiality, integrity, and availability impacts.
A remote attacker controlling a malicious RDP server can exploit this flaw against any connecting FreeRDP client without requiring authentication or user interaction. Successful exploitation triggers a heap buffer overflow, reliably causing a client-side crash for denial-of-service (DoS). Depending on the memory allocator and heap layout, it may also enable heap corruption, potentially leading to arbitrary code execution on the client system.
FreeRDP version 3.21.0 patches the issue with bounds checks in the ClearCodec decode path. The GitHub security advisory (GHSA-3frr-mp8w-4599) details the fix, with relevant code changes visible in libfreerdp/codec/clear.c at lines 878-879 and 883-884, and the release available at the 3.21.0 tag. Security practitioners should prioritize upgrading affected clients to mitigate risk.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side heap buffer overflow in FreeRDP exploited via a malicious RDP server, directly enabling arbitrary code execution through Exploitation for Client Execution (T1203).