CVE-2026-22858 is a critical global buffer overflow (CVSS 9.1) in the Base64 decoder of FreeRDP before version 3.20.1. On Arm and AArch64 builds, a character range check is optimised away, so non ASCII bytes index a lookup table out of bounds. The fix is FreeRDP 3.20.1, so upgrade.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the Base64 decoding path. The record says plain char is unsigned on Arm and AArch64 builds, so the guard that rejects non positive values can be optimised into a plain nonzero check, and bytes from 0x80 to 0xFF can bypass the range restriction and index a global lookup table.
The record also lists Red Hat errata: RHSA-2026:19033, RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334. If you get FreeRDP from your Linux distribution, use the distribution advisory, because packages can carry the fix under an older version number.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weaknesses are CWE-125, CWE-758 and CWE-787. The last is reliance on undefined or implementation defined behaviour, and it explains the shape of this bug. Whether a plain char is signed or unsigned depends on the platform, and the check the authors wrote assumed signed.
That means the same source was safe on one architecture and unsafe on another. If you run FreeRDP on Arm, such as on Apple silicon, Raspberry Pi class devices or Arm servers, this one is for you. The vector rates confidentiality and availability impact as high and integrity as none. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The lesson for code review is to write range checks on explicitly signed or unsigned types.
Quick check
Does this affect x86 builds?
The record describes the problem as happening on Arm and AArch64 builds, where plain char is unsigned.
Why does the compiler matter?
The guard written for a signed char can be simplified by the compiler when the type is unsigned, which removes the intended range check.
Sources
Last reviewed: 19 October 2026.
