CVE-2026-25941: freerdp Improper Input Validation
Vulnerability summary
CVE-2026-25941 is a high (CVSS 8.1) Improper Input Validation vulnerability in freerdp. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 25-02-2026PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a `bitmapDataLength` value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.15 pp
From 0.28% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFreerdp
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.5.1+dfsg1-0ubuntu1.4 | < 3.16.0+dfsg-2ubuntu0.3
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3< 3.15.0+dfsg-2.1+deb13u1 | < 3.23.0+dfsg-1
Freerdp1 product
- freerdp≥ 2.0.0, < 2.11.8 | ≥ 3.0.0, < 3.23.0
3 vendors · 6 products
References
6 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8X Refsource CONFIRMREPORTExploitMitigationPatchVendor Advisory
