CVE-2026-26955 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP clients, such as xfreerdp, should be aware of this vulnerability and take action to mitigate it. This includes upgrading to version 3.23.0 or applying patches provided by vendors. Additionally, defenders should monitor for potential exploitation attempts and implement compensating controls to detect and prevent attacks.

Technical summary

The vulnerability is caused by a lack of bounds checking in the gdi_SurfaceCommand_ClearCodec() handler. Specifically, the handler does not call is_within_surface() to validate the command rectangle against the destination surface dimensions. This allows an attacker to send a crafted RDPGFX ClearCodec surface command that triggers a heap buffer overflow. The overflow corrupts an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, allowing for indirect function pointer call exploitation.

Defensive priority

High

Recommended defensive actions

• Upgrade to FreeRDP version 3.23.0 or later
• Apply patches provided by vendors, such as Red Hat
• Monitor for potential exploitation attempts
• Implement compensating controls to detect and prevent attacks
• Perform inventory checks to identify affected systems

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and potential mitigations. The source item URL provides additional context and references. The CVE-2026-26955 CVE record and NVD detail indicate that the vulnerability has a high CVSS score of 8.8.

Official resources