CVE-2026-23532 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP clients should prioritize updating to version 3.21.0 or later. Additionally, defenders and security teams should be aware of the potential for exploitation and monitor for suspicious activity. Red Hat users can refer to errata RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, and others for specific guidance.

Technical summary

The vulnerability exists in the FreeRDP client’s `gdi_SurfaceToSurface` path, where a mismatch between destination rectangle clamping and the actual copy size leads to a client-side heap buffer overflow. This can be triggered by a malicious server, potentially causing a crash (DoS) and heap corruption with code-execution risk. The issue is patched in version 3.21.0. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.7, indicating a high severity level.

Defensive priority

High priority should be given to updating FreeRDP clients to version 3.21.0 or later. Defenders should also enhance monitoring for potential exploitation attempts and apply additional security measures as necessary.

Recommended defensive actions

• Update FreeRDP clients to version 3.21.0 or later.
• Monitor for potential exploitation attempts.
• Apply compensating controls as needed.
• Refer to Red Hat errata for specific guidance (RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, etc.).
• Review and update incident response plans.

Evidence notes

The CVE-2026-23532 vulnerability is documented in the official CVE record and the National Vulnerability Database (NVD). Additional information and patches are available from the FreeRDP GitHub repository and Red Hat errata pages. The vulnerability has a CVSS score of 7.7, indicating high severity.

Official resources