PT-2026-22004 · Freerdp+2 · Freerdp+2

Ehdgks0627 · Published 2026-01-01 · Updated 2026-04-25 · CVE-2026-25942

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function xf rail server execute result indexes the global error code names[] array with an unchecked value, execResult->execResult, received from the server. This allows for a read outside the bounds of the array when the server sends a value of 7 or greater for execResult. The error code names[] array has 7 elements, with valid indices ranging from 0 to 6.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2026-04137

CVE-2026-25942

GHSA-78Q6-67M7-WWF6

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Ubuntu

References · 76

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25942.json · Exploit
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528 · Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6 · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b · Patch
• https://ubuntu.com/security/CVE-2026-23732 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10408-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22852 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25959 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22853 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25942 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27951 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22855 · Vendor Advisory