CVE-2026-25942 - Vulnerability Analysis

Overview

FreeRDP < 3.23.0 contains an out-of-bounds read caused by unchecked indexing of the global error_code_names array in xf_rail_server_execute_result, letting remote attackers read memory out-of-bounds, exploit requires crafted server response.

Severity & Score

Impact

Remote attackers can read out-of-bounds memory, potentially leaking sensitive information or causing application crashes.

Mitigation

Update to version 3.23.0 or later.

References

• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46
• https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 1, 2026

🟠 CVE-2026-25942 - High (7.5) FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value re... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25942/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner