Out-of-bounds Read in Freerdp
CVE-2026-22858
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
Vulnerability class: Buffer Overflow
EPSS: 0.006 (47.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Freerdp — versions < 3.20.1
Weakness classification (CWE)
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896 (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 (x_refsource_MISC, Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-22858?
- CVE-2026-22858 is a critical-severity vulnerability in Freerdp, classified under Out-of-bounds Read. CVSS score: 9.1/10. Published 2026-01-14.
- How severe is CVE-2026-22858?
- Critical severity. CVSS v3 base score is 9.1 out of 10.