CVE
CVE-2026-23532
freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (important)
DOCUMENTATION: A flaw was found in FreeRDP. A malicious server can exploit a client-side heap buffer overflow vulnerability in the gdi_SurfaceToSurface path. This vulnerability, caused by a mismatch in memory handling, can lead to a crash (Denial of Service) of the client application. Furthermore, it carries a risk of heap corruption, which could potentially enable arbitrary code execution on the affected system.
STATEMENT: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
7.7
-
4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
-
C
H
U
-
Related Resources
No items found.
References
https://access.redhat.com/security/cve/CVE-2026-23532
Basic Information
Ecosystem
