CVE-2026-22852 is a critical heap buffer overflow (CVSS 9.8) in FreeRDP, the open source Remote Desktop Protocol implementation, before version 3.20.1. A malicious RDP server can trigger it through Audio Input format lists in the client. The fix is FreeRDP 3.20.1, so upgrade clients.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the Audio Input (AUDIN) channel of the client. The record says audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS messages and writes past the newly allocated formats array.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weakness is CWE-787, an out of bounds write on the heap. The record says a counter was kept between several format list messages from the server, while the array it indexed was allocated fresh each time. A second message can then write beyond the end of the new array.
The result in the record is memory corruption and a crash. Because the server controls the messages, the exposure runs from server to client, which means connecting to an untrusted or compromised RDP host is the risk. The 9.8 score reflects high impact on all three axes. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix pattern is to reset or validate the count against the allocation for each message.
Try it yourself
Clients often live in container images and build tools. See how an image scan finds an old library inside one.
Click through it at your own pace, or open it full screen.
Quick check
Who is the attacker here?
A malicious RDP server, per the record. The client is the target when it connects.
Is this the only FreeRDP fix in 3.20.1?
No. FreeRDP 3.20.1 also fixes CVE-2026-22853, CVE-2026-22854, CVE-2026-22855, CVE-2026-22857, CVE-2026-22858 and CVE-2026-22859.
Sources
Last reviewed: 19 October 2026.
