Client-Side Heap Buffer Overflow in FreeRDP by FreeRDP

CVE-2026-23533

What is CVE-2026-23533?

A vulnerability in FreeRDP allows for a client-side heap buffer overflow due to mishandled data in the RDPGFX ClearCodec decode path. Specifically, when a malicious server sends crafted data, it can lead to out-of-bounds writes. This may result in a denial-of-service (DoS) scenario and poses risks of heap corruption, which could enable code execution depending on the allocator's behavior and the surrounding heap layout. The issue affects versions of FreeRDP prior to 3.21.0, but has been addressed in the latest release.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References