CVE-2026-22859: freerdp Out-of-bounds Read
CVSS: 9.1v3.1CriticalModified
AliasesUBUNTU-CVE-2026-22859DEBIAN-CVE-2026-22859CGA-7ffg-5jmh-fv25CGA-f588-f4wf-7x2xCGA-q665-8phm-vh64CGA-w3qr-4mm3-x78c
Published 14-01-2026Last modified 19-08-2026
Vulnerability summary
CVE-2026-22859 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in freerdp. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
0.89%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 25 · Related 10MGASA-2026-0086OPENSUSE-SU-2026:10059-1OPENSUSE-SU-2026:10176-1OPENSUSE-SU-2026:20320-1OPENSUSE-SU-2026:20339-1RHSA-2026:19033RHSA-2026:3067RHSA-2026:3068RHSA-2026:3334RHSA-2026:3975RHSA-2026:4121RHSA-2026:4433RHSA-2026:4437RHSA-2026:4438RHSA-2026:4439RHSA-2026:4440RHSA-2026:4446RHSA-2026:4471RHSA-2026:4489SUSE-SU-2026:0345-1SUSE-SU-2026:0417-1SUSE-SU-2026:0421-1SUSE-SU-2026:0449-1SUSE-SU-2026:0559-1USN-8105-1
Timeline
- 14-01-2026PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
CVSS metrics
9 scores · 6 sources · 2 versionsMedium 5.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:PSources5 sources · 5.6–6.1
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST5.6MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSources4 sources · 7.4–9.1
- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
+0.02 pp
From 0.87% on 20-09-2026
20-09-202620-10-2026
EPSS score0.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFreerdp
Maturity: poc
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Affected systems
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.5.1+dfsg1-0ubuntu1.4 | < 3.16.0+dfsg-2ubuntu0.3 | < 3.20.2+dfsg-1
Chainguard2 products
- freerdp-devAll versions (No fix recorded)
- freerdp-libsAll versions (No fix recorded)
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3< 3.15.0+dfsg-2.1+deb13u1 | < 3.20.2+dfsg-1
Wolfi2 products
- freerdp-devAll versions (No fix recorded)
- freerdp-libsAll versions (No fix recorded)
Freerdp1 product
- freerdp< 3.20.1
5 vendors · 10 products
References
25 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36X Refsource CONFIRMREPORTAdvisoryExploitVendor Advisory
