CVE-2026-23534
Published: 19 January 2026
Summary
CVE-2026-23534 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23534 is a client-side heap buffer overflow vulnerability (CWE-122) in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). It affects versions prior to 3.21.0 and occurs in the ClearCodec bands decode path, where crafted band coordinates enable writes beyond the end of the destination surface buffer. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high confidentiality, integrity, and availability impacts.
A remote attacker controlling a malicious RDP server can exploit this flaw against any connecting FreeRDP client without requiring authentication or user interaction. Successful exploitation triggers a heap buffer overflow, reliably causing a client-side crash for denial-of-service (DoS). Depending on the memory allocator and heap layout, it may also enable heap corruption, potentially leading to arbitrary code execution on the client system.
FreeRDP version 3.21.0 patches the issue with bounds checks in the ClearCodec decode path. The GitHub security advisory (GHSA-3frr-mp8w-4599) details the fix, with relevant code changes visible in libfreerdp/codec/clear.c at lines 878-879 and 883-884, and the release available at the 3.21.0 tag. Security practitioners should prioritize upgrading affected clients to mitigate risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3314
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer.…
more
A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a client-side heap buffer overflow in FreeRDP exploited via a malicious RDP server, directly enabling arbitrary code execution through Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of the heap buffer overflow flaw in FreeRDP by upgrading to the patched version 3.21.0.
Requires validation of untrusted inputs like crafted ClearCodec band coordinates to prevent writes beyond the destination surface buffer.
Implements memory protections such as ASLR and DEP to mitigate heap corruption and potential code execution from the buffer overflow.