CVE-2026-22854
Published: 14 January 2026
Summary
CVE-2026-22854 is a medium-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freerdp Freerdp. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22854 is a heap buffer overflow vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). Affecting versions prior to 3.20.1, the issue arises during drive read operations when a server-controlled read length is used to copy file data into an IRP output stream buffer lacking a hard upper bound. This enables an oversized read that overwrites adjacent heap memory. The vulnerability, published on 2026-01-14, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-122 (Heap-based Buffer Overflow).
A remote attacker can exploit this vulnerability over the network without authentication, privileges, or user interaction. By crafting a malicious RDP server response with an oversized read length, the attacker triggers the buffer overflow during a client connection attempt, potentially achieving arbitrary heap memory corruption. This could lead to remote code execution, denial of service, or data tampering on the affected FreeRDP client system, given the high impacts on confidentiality, integrity, and availability.
The FreeRDP project addressed the vulnerability in version 3.20.1, as detailed in the release notes and security advisory. Security practitioners should update to FreeRDP 3.20.1 or later to mitigate the issue, with further details available in the GitHub release at https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 and the advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2673
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper…
more
bound, allowing an oversized read to overwrite heap memory. This vulnerability is fixed in 3.20.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in FreeRDP client enables direct remote code execution via malicious RDP server response during client-initiated connection (Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, testing, and installation of security patches for known flaws, directly addressing the heap buffer overflow in FreeRDP by mandating update to version 3.20.1 or later.
SI-16 implements memory protections such as address space randomization and non-executable memory regions that mitigate heap buffer overflow exploits by preventing unauthorized code execution from corrupted heap memory.
SI-10 enforces validation of untrusted inputs like server-controlled read lengths in RDP drive operations, preventing oversized reads that trigger the buffer overflow.