PT-2026-3456 · Freerdp+4 · Freerdp+4

Ehdgks0627 · Published 2026-01-01 · Updated 2026-06-11 · CVE-2026-23531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.21.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. In ClearCodec, when glyphData is present, the clear decompress function calls freerdp image copy no overlap without validating the destination rectangle. This can lead to an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client-side heap buffer overflow, potentially causing a denial of service (DoS) and heap corruption, which may lead to code execution depending on the allocator behavior and heap layout.

Recommendations Update to version 3.21.0 or later.

Exploit

Fix

DoS

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

ALSA-2026:2048

ALSA-2026:2081

ALSA-2026:2222

BDU:2026-00656

CVE-2026-23531

GHSA-XJ5H-9CR5-23C5

MGASA-2026-0046

OESA-2026-1516

OESA-2026-1517

OESA-2026-1518

OESA-2026-1519

OESA-2026-1520

OESA-2026-1521

OPENSUSE-SU-2026:10107-1

OPENSUSE-SU-2026:10176-1

OPENSUSE-SU-2026:20320-1

OPENSUSE-SU-2026:20339-1

RHSA-2026:2048

RHSA-2026:2081

RHSA-2026:2222

RHSA-2026:2714

RHSA-2026:2736

RHSA-2026:2770

RHSA-2026:2824

RHSA-2026:2952

RHSA-2026:3036

RHSA-2026:3037

RHSA-2026:3038

RHSA-2026:3039

RHSA-2026:3041

SUSE-SU-2026:0345-1

SUSE-SU-2026:0417-1

SUSE-SU-2026:0421-1

SUSE-SU-2026:0449-1

SUSE-SU-2026:0559-1

USN-8004-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 228

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23531.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23732 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26986 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23531 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27950 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0421-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22855 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24676 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-2714.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23884 · Security Note
• https://ubuntu.com/security/CVE-2026-25954 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23531 · Vendor Advisory