CVE-2026-25942
Published: 25 February 2026
Summary
CVE-2026-25942 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in FreeRDP client triggered by malicious RDP server directly enables application exploitation to crash the client (availability impact only).
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server…
more
sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.
Deeper analysisAI
CVE-2026-25942 is an out-of-bounds read vulnerability (CWE-125) in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.23.0. The flaw resides in the `xf_rail_server_execute_result` function within the RAIL channel client code, which indexes the global `error_code_names[]` array—limited to 7 elements with valid indices 0 through 6—using an unchecked `execResult->execResult` value supplied by the server. A server-sent value of 7 or greater triggers the out-of-bounds read.
A remote, unauthenticated attacker can exploit this by hosting a malicious RDP server. When a victim initiates a connection using a vulnerable FreeRDP client, the attacker sends a crafted `execResult` value during RAIL protocol handling, causing the out-of-bounds read. This leads to a denial-of-service condition, such as client application crash or termination, with no impact on confidentiality or integrity. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting network accessibility, low attack complexity, and no need for privileges or user interaction beyond establishing the RDP session.
FreeRDP version 3.23.0 resolves the issue via commit 9362a0bf8dda04eedbca07d5dfaec1044e67cc6b, which adds bounds checking on the `execResult->execResult` value before array access. Practitioners should recommend immediate upgrades to 3.23.0 or later for affected clients, with code details available in the referenced rail_orders.c and xf_rail.c files.
Details
- CWE(s)