CVE-2026-23732: freerdp Heap-based Buffer Overflow
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-23732DEBIAN-CVE-2026-23732CGA-4797-xh59-3xm7CGA-7vm6-6g4m-5548CGA-888g-2rh3-mh9xCGA-j44v-q3vc-2p4g
Published 19-01-2026Last modified 20-01-2026
Vulnerability summary
CVE-2026-23732 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in freerdp. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.58%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 24 · Related 10MGASA-2026-0086OPENSUSE-SU-2026:10107-1OPENSUSE-SU-2026:10459-1OPENSUSE-SU-2026:20339-1RHSA-2026:10076RHSA-2026:10734RHSA-2026:10735RHSA-2026:10951RHSA-2026:11323RHSA-2026:19033RHSA-2026:6340RHSA-2026:6727RHSA-2026:6743RHSA-2026:6799RHSA-2026:6918RHSA-2026:6958RHSA-2026:9640RHSA-2026:9641SUSE-SU-2026:0345-1SUSE-SU-2026:0656-1SUSE-SU-2026:0683-1SUSE-SU-2026:0761-1SUSE-SU-2026:0762-1USN-8105-1CGA-8MVX-WR26-6PHR
Timeline
- 19-01-2026PublishedVulnerability first disclosed.
- 20-01-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.
CVSS metrics
8 scores · 6 sources · 2 versionsMedium 5.5Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PSources5 sources · 5.5–6.9
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.01 pp
From 0.56% on 20-09-2026
20-09-202620-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFreerdp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.5.1+dfsg1-0ubuntu1.4 | < 3.16.0+dfsg-2ubuntu0.3
Chainguard2 products
- freerdp-devAll versions (No fix recorded)
- freerdp-libsAll versions (No fix recorded)
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3< 3.15.0+dfsg-2.1+deb13u1 | < 3.21.0+dfsg-1
Wolfi2 products
- freerdp-devAll versions (No fix recorded)
- freerdp-libsAll versions (No fix recorded)
Freerdp1 product
- freerdp< 3.21.0
5 vendors · 10 products
References
12 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3ppX Refsource CONFIRMREPORTAdvisoryExploitVendor Advisory
- github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/cache/glyph.cX Refsource MISCREPORTWEBProduct
- github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/codec/color.cX Refsource MISCREPORTWEBProduct
- github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/graphics.cX Refsource MISCREPORTWEBProduct
- github.com/FreeRDP/FreeRDP/blob/f96ee2a6dd02739325c2a4e36a14978b561f00ea/libfreerdp/core/orders.cX Refsource MISCREPORTWEBProduct
