CVE-2026-23531
Published: 19 January 2026
Summary
CVE-2026-23531 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-23531 is a heap buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.21.0. The issue resides in the ClearCodec component, where the `clear_decompress` function calls `freerdp_image_copy_no_overlap` without validating the destination rectangle when `glyphData` is present. This flaw enables out-of-bounds read/write operations through crafted RDPGFX surface updates, classified under CWE-122 (Heap-based Buffer Overflow) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A malicious RDP server can exploit this vulnerability against connecting FreeRDP clients over the network with no privileges or user interaction required. Successful exploitation triggers a client-side heap buffer overflow, reliably causing a denial-of-service via application crash, and potentially leading to heap corruption with code execution risk contingent on the memory allocator's behavior and surrounding heap layout.
The FreeRDP security advisory (GHSA-xj5h-9cr5-23c5) and release notes for version 3.21.0 detail the patch, which addresses the validation issue in `clear.c` at lines 1139-1145. Security practitioners should update affected FreeRDP clients to version 3.21.0 or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3317
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server…
more
can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in FreeRDP client exploitable remotely by malicious RDP server via crafted RDPGFX updates, enabling code execution or DoS on client systems, directly mapping to Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of flaws like the heap buffer overflow in FreeRDP's ClearCodec to prevent exploitation via crafted RDPGFX updates.
Implements memory protection mechanisms such as address space layout randomization and heap isolation to mitigate heap corruption and code execution risks from out-of-bounds reads/writes.
Mandates validation of protocol inputs like destination rectangles in RDP surface updates to prevent heap-based buffer overflows from invalid data.