CVE-2026-22858Critical· 9.1▾ MidnightFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.7%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
freerdp < 3.20.1Upgrade past the affected range:
freerdp 3.20.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22859Critical· 9.1FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-22855Critical· 9.1FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-22853Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-24678High· 7.5FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-91958Medium· 6.6FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors
CVE-2026-45700Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol