CVE-2026-22853 MEDIUM

CVE-2026-22853: FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

Vendor Freerdp

Product FreeRDP

Weakness CWE-787

Published January 14, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

Key dates

02Disclosure timeline

January 14, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-22853

Related vulnerabilities

04Related CVE

CVE-2026-0537 RGB File Parsing Memory Corruption CVE-2021-35989 Adobe Bridge PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability CVE-2022-41742 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742 CVE-2025-59298 File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen CVE-2021-1445 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services VPN Denial of Service Vulnerabilities