CVE-2026-22854 is a critical heap buffer overflow (CVSS 9.8) in the drive redirection code of FreeRDP before version 3.20.1. A read length controlled by the server is used with no hard upper bound, so an oversized read can overwrite heap memory. The fix is FreeRDP 3.20.1, so upgrade.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the drive redirection read path. The record says a server controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weakness is CWE-122, a heap based buffer overflow. The server tells the client how many bytes to read, and the client trusted that number when filling a buffer. A number larger than the buffer allows the read to overwrite memory next to it.
Drive redirection lets a remote session reach a local folder, so it is a feature many teams enable for convenience. If you do not need it, turning it off removes a path to this code. The record rates all impacts as high and the score is 9.8. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix is to cap the read at the size of the buffer, whatever the server asks for.
Quick check
Should I disable drive redirection?
If you do not need it, yes, as a general hardening step. The fix is still the upgrade to 3.20.1.
Who controls the length?
The server, per the record. A malicious or compromised RDP host is the risk.
Sources
Last reviewed: 19 October 2026.
