Heap Buffer Overflow in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-23534

What is CVE-2026-23534?

FreeRDP, an open-source implementation of the Remote Desktop Protocol, is susceptible to a client-side heap buffer overflow. This vulnerability allows a malicious server to craft specific band coordinates that can lead to writes beyond the destination surface buffer. Consequently, this could result in a crash or potential heap corruption, posing risks for executing arbitrary code based on allocator behavior and heap layout. For protection, users are urged to update to version 3.21.0, which addresses the vulnerability.

References