CNNVD-202601-3028 Information

Jan 19, 2026 cve

CNNVD ID

CNNVD-202601-3028

CVE-2026-23533

CNNVD Published: 2026-01-19

Description (Chinese)

FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 3.21.0之前版本存在安全漏洞，该漏洞源于RDPGFX ClearCodec解码路径中特制的残留数据可能导致颜色输出时越界写入，进而引发堆缓冲区溢出，造成崩溃或任意代码执行。

Description (English)

FreeRDP is an open-source remote desktop protocol (RDP) for the FreeRDP team. There is a security loophole in the pre-Free RDP 3.21.0 version, which stems from the fact that unique data from the RDPGFX ClearCodec decoded path may result in cross-border writing when the colour is exported, thus triggering a spill over the buffer zone, causing a collapse or arbitrary code execution.

Hazard Level

Medium

Vulnerability Type

其他

Affected Vendor

FreeRDP

Published

2026-01-19

Last Modified

2026-02-24

References

https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L268-L281 https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/clear.c#L336 https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v https://access.redhat.com/security/cve/cve-2026-23533

Patch

https://github.com/FreeRDP/FreeRDP/releases

Share on: