CVE-2026-22853 is a critical heap buffer overflow (CVSS 9.8) in FreeRDP before version 3.20.1. The RDPEAR NDR array reader does not check the element count taken from the wire, so it can write past the heap buffer allocated for it. The fix is FreeRDP 3.20.1, so upgrade.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the RDPEAR NDR array reader, in the function ndr_read_uint8Array. The record says the reader does not perform bounds checking on the on the wire element count, and can write past the heap buffer allocated from hints.
The record also lists Red Hat errata: RHSA-2026:19033, RHSA-2026:3068, RHSA-2026:4121. If you get FreeRDP from your Linux distribution, use the distribution advisory, because packages can carry the fix under an older version number.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weakness is CWE-787, an out of bounds write. The pattern is familiar: a length field arrives in network data, and the code trusts it when copying into a buffer sized from somewhere else. When the two disagree, the copy runs past the end of the buffer.
The record states the outcome as a heap buffer overflow in ndr_read_uint8Array. The vector shows network access, low complexity and no privileges, with high impact on all three axes. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix is a bound on the count before the read. Parsers of network formats are best checked with fuzzing, and every length that comes from the wire needs validation.
Quick check
Is it the same bug as CVE-2026-22852?
No. Both are heap overflows fixed in 3.20.1, but this one is in the RDPEAR array reader and the other is in audio input format handling.
Where are the fixed versions for my distribution?
In your distribution advisory. The record lists Red Hat errata, for example RHSA-2026:3068.
Sources
Last reviewed: 19 October 2026.
