PT-2026-22003 · Freerdp+3 · Freerdp+3

Pavelkohout396 · Published 2026-01-01 · Updated 2026-06-09 · CVE-2026-25941

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.11.8 FreeRDP versions prior to 3.23.0

Description FreeRDP, a free implementation of the Remote Desktop Protocol, contains an out-of-bounds read issue in the FreeRDP client’s RDPGFX channel. A malicious RDP server can exploit this by sending a crafted WIRE TO SURFACE 2 Protocol Data Unit (PDU) with a bitmapDataLength value exceeding the actual data within the packet. This can result in information disclosure or client crashes when a user connects to a malicious server. The vulnerability occurs when reading uninitialized heap memory.

Recommendations Update to FreeRDP version 2.11.8 or later. Update to FreeRDP version 3.23.0 or later.

Exploit

Fix

DoS

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

BDU:2026-04136

CVE-2026-25941

GHSA-3546-X645-5CF8

OESA-2026-1516

OESA-2026-1517

OESA-2026-1518

OESA-2026-1519

OESA-2026-1520

OESA-2026-1521

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Red Os

Ubuntu

References · 113

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25941.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8 · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25997 · Security Note
• https://ubuntu.com/security/notices/USN-8105-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04136 · Security Note
• https://ubuntu.com/security/CVE-2026-25942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23883 · Security Note
• https://osv.dev/vulnerability/USN-8105-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23531 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23533 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1520 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24682 · Security Note
• https://ubuntu.com/security/CVE-2026-23732 · Vendor Advisory