CVE-2026-22855
Published: 14 January 2026
Summary
CVE-2026-22855 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Freerdp Freerdp. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-22855 is a heap out-of-bounds read vulnerability (CWE-125) in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The issue affects versions prior to 3.20.1 and occurs in the smartcard SetAttrib path when the cbAttrLen value does not match the actual NDR buffer length, potentially leading to unauthorized memory access. Published on January 14, 2026, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), indicating critical severity due to high impacts on confidentiality and availability.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. By crafting a malicious RDP connection involving a malformed smartcard attribute, an unauthenticated adversary can trigger the out-of-bounds read, potentially disclosing sensitive heap data or causing denial of service through application crashes.
The FreeRDP security advisory (GHSA-rwp3-g84r-6mx9) and release notes for version 3.20.1 detail the fix, recommending immediate upgrades to 3.20.1 or later to mitigate the issue. No additional workarounds are specified in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2672
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a public-facing RDP implementation (FreeRDP) via crafted malicious connection, matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation by patching FreeRDP to version 3.20.1 or later, directly eliminating the heap out-of-bounds read vulnerability.
Mandates validation of input lengths like cbAttrLen against actual NDR buffer sizes in the smartcard SetAttrib path to block malformed RDP connections.
Implements memory protections such as heap isolation and guard pages to prevent unauthorized access and exploitation of out-of-bounds heap reads.