ZeroDay Findings
Sign inSign up

Findings

CVE-2026-26955

FreeRDP is a free implementation of the Remote Desktop Protocol.

Published Feb 25, 2026 · updated Jul 15, 2026 · freerdp freerdp

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., ) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The handler does not call to validate the command rectangle against the destination surface dimensions, allowing attacker-controlled / (and subcodec rectangle offsets) to reach image copy routines that write into without bounds enforcement. The OOB write corrupts an adjacent struct's pointer with attacker-controlled pixel data, and corruption of is sufficient to reach an indirect function pointer call ( at ) on a subsequent codec command — full instruction pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to receive a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., ) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The handler does not call to validate the command rectangle against the destination surface dimensio

  2. Jul 15, 2026 · NIST NVD

    Updated

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., ) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The handler does not call to validate the command rectangle against the destination surface dimensio

Affected

  • cpe freerdp/freerdpversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-26955

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-26955

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., ) by sending an RDPGFX ClearCodec surface command with an out-of-

    nvd.nist.gov

References