Out-of-Bounds Read Vulnerability in FreeRDP Client by FreeRDP
CVE-2026-25941
What is CVE-2026-25941?
The FreeRDP client contains an out-of-bounds read vulnerability within its RDPGFX channel, affecting versions prior to 2.11.8 in the 2.x series and 3.23.0 in the 3.x series. This vulnerability allows malicious RDP servers to leverage crafted packets with a bitmapDataLength that exceeds the actual data length, potentially exposing uninitialized heap memory. Users connecting to compromised servers may experience data leaks or client crashes, highlighting the need for immediate updates to secure the application.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
FreeRDP >= 2.0.0, < 2.11.8 < 2.0.0, 2.11.8
FreeRDP >= 3.0.0, < 3.23.0 < 3.0.0, 3.23.0