CVE-2026-25942
Published: 25 February 2026
Summary
CVE-2026-25942 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Freerdp Freerdp. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25942 is an out-of-bounds read vulnerability (CWE-125) in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.23.0. The flaw resides in the `xf_rail_server_execute_result` function within the RAIL channel client code, which indexes the global `error_code_names[]` array—limited to 7 elements with valid indices 0 through 6—using an unchecked `execResult->execResult` value supplied by the server. A server-sent value of 7 or greater triggers the out-of-bounds read.
A remote, unauthenticated attacker can exploit this by hosting a malicious RDP server. When a victim initiates a connection using a vulnerable FreeRDP client, the attacker sends a crafted `execResult` value during RAIL protocol handling, causing the out-of-bounds read. This leads to a denial-of-service condition, such as client application crash or termination, with no impact on confidentiality or integrity. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting network accessibility, low attack complexity, and no need for privileges or user interaction beyond establishing the RDP session.
FreeRDP version 3.23.0 resolves the issue via commit 9362a0bf8dda04eedbca07d5dfaec1044e67cc6b, which adds bounds checking on the `execResult->execResult` value before array access. Practitioners should recommend immediate upgrades to 3.23.0 or later for affected clients, with code details available in the referenced rail_orders.c and xf_rail.c files.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8731
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server…
more
sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in FreeRDP client triggered by malicious RDP server directly enables application exploitation to crash the client (availability impact only).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely patching of flaws like the out-of-bounds read in FreeRDP by upgrading to version 3.23.0 or later.
Requires validation of information inputs such as unchecked server-supplied execResult values to prevent out-of-bounds array access.
Directs error handling to mitigate denial-of-service crashes from out-of-bounds reads without system compromise.