CVE-2026-22859 is a critical out of bounds read (CVSS 9.1) in the URBDRC USB redirection client of FreeRDP before version 3.20.1. Values the server supplies in an MSUSB_INTERFACE_DESCRIPTOR are used as indices without checks. The fix is FreeRDP 3.20.1, so upgrade clients.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in the URBDRC client, in libusb_udev_complete_msconfig_setup. The record says the client does not perform bounds checking on server supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices.
The record also lists Red Hat errata: RHSA-2026:19033, RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334. If you get FreeRDP from your Linux distribution, use the distribution advisory, because packages can carry the fix under an older version number.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weaknesses are CWE-125 and CWE-129. Improper validation of an array index is the cause, and an out of bounds read is the effect. A number sent by the server selects an element, and nothing confirms the number is inside the array.
The vector rates confidentiality and availability impact as high and integrity as none, which matches a read flaw. USB redirection is an optional channel, so turning it off where it is not needed lowers exposure. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix is to compare each index with the array size before using it.
Quick check
Is USB redirection on by default?
The record does not say. Check your client settings and disable it if you do not need it.
Is this the last of the FreeRDP 3.20.1 fixes?
Several other FreeRDP flaws, including CVE-2026-22852 and CVE-2026-22857.
Sources
Last reviewed: 19 October 2026.
