CVE-2026-22855 is a critical heap out of bounds read (CVSS 9.1) in FreeRDP before version 3.20.1. In the smartcard SetAttrib path, the attribute length does not match the actual NDR buffer length. The fix is FreeRDP 3.20.1, so upgrade clients.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the smartcard SetAttrib path. The record says a heap out of bounds read occurs when cbAttrLen does not match the actual NDR buffer length.
The record also lists Red Hat errata: RHSA-2026:19033, RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334. If you get FreeRDP from your Linux distribution, use the distribution advisory, because packages can carry the fix under an older version number.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weakness is CWE-125, an out of bounds read. The code uses a length field from the message and reads that many bytes, while the buffer it holds is shorter. The extra bytes come from neighbouring heap memory.
The vector shows high confidentiality and availability impact and no integrity impact, which fits a read flaw that can leak memory or crash the process. Smartcard redirection is another optional channel. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix is to compare the declared length with the real buffer before reading.
Quick check
Why no integrity impact?
The flaw is a read, not a write. The vector rates confidentiality and availability high and integrity none.
Do I need smartcard redirection enabled?
The record places the flaw in the smartcard path. Turning that channel off where it is not needed reduces exposure, but upgrading is the fix.
Sources
Last reviewed: 19 October 2026.
