CVE-2026-23533 is a critical flaw (CVSS 9.8 in the record) in FreeRDP, the open source Remote Desktop Protocol implementation. In the RDPGFX ClearCodec decode path, crafted residual data caused out of bounds writes during color output. A malicious server can crash the client or corrupt its heap. FreeRDP 3.21.0 fixes it, so upgrade older clients.
What's affected
FreeRDP versions before 3.21.0 are affected. Version 3.21.0 contains the patch.
The 3.21.0 release notes describe a bugfix release that adds new API functions to validate input data, and list this CVE among client side vulnerabilities reported by one researcher. The release notes call these medium severity, while the NVD record scores this one 9.8. Read both numbers as a range, and note the direction of attack: the server attacks the client, not the reverse.
Eight CVEs are named in that release, including four others in the same group, CVE-2026-23530 through CVE-2026-23534. Upgrading once covers all of them.
Many Linux distributions and products package FreeRDP, so check your vendor too. The record references Red Hat errata for packaged fixes.
How to check if you're exposed
Read the version of the client you run, and of any library other tools link against:
xfreerdp /version
pkg-config --modversion freerdp3
Remote desktop clients are embedded in other software, such as remote access tools, VDI clients and some desktop environments. Look at your package manager for FreeRDP packages and at your software inventory for applications that bundle it.
Distribution packages may carry the fix under an older version number, so check your vendor's advisory for this CVE rather than relying on the number alone.
What to do now
- Upgrade FreeRDP to 3.21.0 or later, or install your distribution package that lists the fix.
- Update applications that bundle FreeRDP, as their vendors release builds.
- Connect only to remote desktop servers you trust until the client is updated.
- Avoid connecting through untrusted networks where a server could be impersonated.
Why it matters
The weakness is CWE-122 (Heap-based Buffer Overflow). While writing decoded colors to the output, the code could be driven by crafted residual data to write beyond the buffer. The decoder trusted counts and coordinates that came from the sender.
The attack runs in an unusual direction. Instead of a client attacking a server, a malicious or compromised server sends data that the client trusts too much. Anyone who connects to a server they do not control, such as a vendor's or a lab host, is exposed to what that server sends. The advisory describes a crash and possible heap corruption, with code execution depending on allocator behavior and surrounding memory layout. The record does not mark this CVE as exploited in the wild.
Quick check
Does this attack servers running RDP?
No. The advisory describes a client side overflow triggered by a malicious server.
Which version fixes CVE-2026-23533?
FreeRDP 3.21.0.
Sources
Last reviewed: 19 October 2026.
