Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
Published: 2026-01-14
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Apply Patch
AI Analysis

Impact

FreeRDP includes a heap out‑of‑bounds read when the cbAttrLen parameter does not match the actual buffer length in the smartcard SetAttrib call. The flaw is a read vulnerability that could allow an attacker to read unintended data from memory or cause the client to crash, resulting in information disclosure or denial of service. It is classified as CWE‑125.

Affected Systems

The vulnerability affects the FreeRDP client implementation for all releases prior to version 3.20.1. Systems running any older FreeRDP build are exposed when the smartcard feature is enabled.

Risk and Exploitability

The severity is a moderate CVSS score of 5.6 and an EPSS probability of less than 1 %, and it is not listed in the CISA KEV catalog. Attackers would need to trigger a smartcard SetAttrib request, which can be performed over an RDP session that permits smartcard redirection. The exploit path requires remote or local RDP access with smartcard support enabled; no additional prerequisites are mentioned in the description.

Generated by OpenCVE AI on April 18, 2026 at 06:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.20.1 or later, which patches the bounds check for smartcard SetAttrib.
  • Disable smartcard support in FreeRDP configuration if the feature is not required, thereby preventing the vulnerable code from executing.
  • Monitor RDP traffic for unusual smartcard activity and consider blocking remote hosts that do not require smartcard access.

Generated by OpenCVE AI on April 18, 2026 at 06:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Thu, 15 Jan 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H'}

threat_severity

Moderate

Thu, 15 Jan 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Freerdp
Freerdp freerdp
Vendors & Products Freerdp
Freerdp freerdp

Wed, 14 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Jan 2026 18:00:00 +0000

Type Values Removed Values Added
Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
Title FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-01-14T21:06:26.553Z

Reserved: 2026-01-12T16:20:16.746Z

Link: CVE-2026-22855

cve-icon Vulnrichment

Updated: 2026-01-14T21:06:23.536Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-14T18:16:43.080

Modified: 2026-01-20T18:36:35.953

Link: CVE-2026-22855

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-01-14T17:50:06Z

Links: CVE-2026-22855 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T06:30:25Z

Weaknesses