CVE-2026-26955 FreeRDP has Out-of-bounds Write
A malicious RDP server can trigger a heap buffer overflow in FreeRDP clients, leading to arbitrary code execution via corrupted function pointers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26955?
CVE-2026-26955 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top` (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.
Which versions are affected by CVE-2026-26955?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-26955?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-26955 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26955 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-26955, GHSA-mr6w-ch7c-mqqj, UBUNTU-CVE-2026-26955.