CVE-2026-23532
Published: 19 January 2026
Summary
CVE-2026-23532 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 42.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-17 (Remote Access).
Deeper analysis
CVE-2026-23532 is a client-side heap buffer overflow vulnerability (CWE-122) in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The issue affects FreeRDP clients prior to version 3.21.0 and occurs in the `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size performed during surface operations.
A malicious RDP server can exploit this vulnerability against any unauthenticated client that connects to it over the network, requiring no user interaction or privileges (CVSSv3.1 score of 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation triggers a heap buffer overflow, reliably causing a client denial-of-service (crash) and potentially leading to heap corruption with code execution risk, contingent on the memory allocator's behavior and surrounding heap layout.
The FreeRDP project has addressed the vulnerability in version 3.21.0, as detailed in the project's security advisory (GHSA-fq8c-87hj-7gvr) and release notes. Security practitioners should update to FreeRDP 3.21.0 or later; the patch is visible in the codebase at libfreerdp/gdi/gfx.c lines 1368-1382.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3316
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A…
more
malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Client-side heap buffer overflow in FreeRDP RDP client exploitable by malicious server for code execution or DoS, directly enabling T1203: Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and patching of the heap buffer overflow vulnerability in FreeRDP clients to version 3.21.0 or later.
Implements memory protection mechanisms like ASLR and non-executable heap to mitigate exploitation of the heap buffer overflow for code execution.
Restricts and authorizes RDP client connections to trusted servers only, reducing exposure to malicious RDP servers that trigger the vulnerability.