---
id: CVE-2026-22853
title: FreeRDP is a free implementation of the Remote Desktop Protocol
summary: >-
  FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to
  3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the
  on‑wire element count and can write past the heap buffer allocated from hints,
  causing a …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-787
vendor: freerdp
product: freerdp
affected:
  - freerdp < 3.20.1
patched:
  - freerdp 3.20.1
published: '2026-01-14'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22853'
references:
  - url: 'https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1'
    label: security-advisories@github.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:19033'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3068'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:4121'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-22853'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2429647'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22853.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00759
epssPercentile: 0.53296
ingestedAt: '2026-06-30T13:26:50.485Z'
---

## Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1.

## Affected

- `freerdp < 3.20.1`

## Remediation

Upgrade past the affected range:

- `freerdp 3.20.1`