CVE-2026-22858 | BDVDB-2026-310700 Detail
FreeRDPFreeRDP
Description#
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
References#
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
- https://access.redhat.com/security/cve/CVE-2026-22858
- https://bugzilla.redhat.com/show_bug.cgi?id=2429649
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22858.json
- https://access.redhat.com/errata/RHSA-2026:4471
- https://access.redhat.com/errata/RHSA-2026:4121
- https://access.redhat.com/errata/RHSA-2026:3068
- https://access.redhat.com/errata/RHSA-2026:19033
- https://access.redhat.com/errata/RHSA-2026:3334
- https://access.redhat.com/errata/RHSA-2026:4433
- https://access.redhat.com/errata/RHSA-2026:4439
- https://access.redhat.com/errata/RHSA-2026:4446
- https://access.redhat.com/errata/RHSA-2026:4440
- https://access.redhat.com/errata/RHSA-2026:4489
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.