Heap Buffer Overflow in FreeRDP Remote Desktop Clients

CVE-2026-26955

What is CVE-2026-26955?

FreeRDP, a free implementation of the Remote Desktop Protocol, is susceptible to a heap buffer overflow vulnerability that could be triggered by a malicious RDP server. Attackers can exploit this weakness by sending an invalid RDPGFX ClearCodec surface command containing an out-of-bounds destination rectangle to unpatched clients. This oversight in the gdi_SurfaceCommand_ClearCodec() function allows for out-of-bounds writes, which can corrupt adjacent memory structures, leading to potential remote code execution. Users are urged to upgrade to version 3.23.0 or later to mitigate the risks associated with this vulnerability.

References