CVE-2026-26955 - Vulnerability Analysis

Overview

FreeRDP < 3.23.0 contains a heap buffer overflow caused by missing bounds validation in the GDI surface pipeline ClearCodec command, letting malicious RDP servers execute arbitrary code remotely, exploit requires connection to a malicious server.

Severity & Score

Impact

Malicious RDP servers can execute arbitrary code on FreeRDP clients, potentially leading to full system compromise.

Mitigation

Upgrade to version 3.23.0 or later.

References

• https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2026-26955 - High (8.8) FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCode... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26955/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner