Buffer Over-read in FreeRDP - CVE-2026-26271

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125347

Buffer Over-read in FreeRDP - CVE-2026-26271

Published: April 8, 2026


Vulnerability identifier: #VU125347
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26271
CWE-ID: CWE-126
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to buffer over-read in freerdp_image_copy_from_icon_data() when processing crafted RDP window icon data. A remote attacker can send specially crafted icon data to disclose sensitive information.

The issue is reachable over the network when a client processes icon data from an RDP server or a man-in-the-middle position.


Affected software

FreeRDP
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Fedora
winpr2-devel
freerdp-devel
freerdp-debuginfo
freerdp-wayland
freerdp-proxy-debuginfo
freerdp-server
libuwac0-0
libfreerdp2
libuwac0-0-debuginfo
freerdp
freerdp-server-debuginfo
freerdp-debugsource
libfreerdp2-debuginfo
libwinpr2
freerdp-wayland-debuginfo
uwac0-0-devel
libwinpr2-debuginfo
freerdp-proxy
libfreerdp2-2
libfreerdp2-2-debuginfo
winpr-devel
libwinpr2-2-debuginfo
libwinpr2-2
freerdp2-proxy
freerdp2-server
freerdp2-proxy-debuginfo
freerdp2
freerdp2-server-debuginfo
freerdp2-devel
freerdp2-debugsource
freerdp2-debuginfo
freerdp-help
libwinpr
libwinpr-devel
freerdp3 (Ubuntu package)
libfreerdp-server-proxy3-3-debuginfo
libwinpr3-3
libfreerdp3-3
freerdp-sdl
libwinpr3-3-debuginfo
librdtk0-0-debuginfo
libfreerdp3-3-debuginfo
freerdp-sdl-debuginfo
librdtk0-0
freerdp-proxy-plugins
freerdp-proxy-plugins-debuginfo
libfreerdp-server-proxy3-3

How to mitigate CVE-2026-26271

Install security update from vendor's website.

FreeRDP - update to 3.23.0
winpr2-devel - addressed in versions 2.1.2-12.63.1, 2.4.0-150400.3.47.1, 2.11.7-150700.3.14.1
freerdp-devel - addressed in versions 2.1.2-12.63.1, 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-debuginfo - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-wayland - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-proxy-debuginfo - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-server - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
libuwac0-0 - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
libfreerdp2 - update to 2.4.0-150400.3.47.1
libuwac0-0-debuginfo - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-server-debuginfo - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
freerdp-debugsource - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
libfreerdp2-debuginfo - update to 2.4.0-150400.3.47.1
libwinpr2 - update to 2.4.0-150400.3.47.1
freerdp-wayland-debuginfo - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
uwac0-0-devel - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1
libwinpr2-debuginfo - update to 2.4.0-150400.3.47.1
freerdp-proxy - addressed in versions 2.4.0-150400.3.47.1, 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
libfreerdp2-2 - addressed in versions 2.11.2-150600.4.18.1, 2.11.7-150700.3.14.1
libfreerdp2-2-debuginfo - addressed in versions 2.11.2-150600.4.18.1, 2.11.7-150700.3.14.1
winpr-devel - addressed in versions 2.11.2-150600.4.18.1, 3.10.3-150700.3.9.1
libwinpr2-2-debuginfo - addressed in versions 2.11.2-150600.4.18.1, 2.11.7-150700.3.14.1
libwinpr2-2 - addressed in versions 2.11.2-150600.4.18.1, 2.11.7-150700.3.14.1
freerdp2-proxy - update to 2.11.7-150700.3.14.1
freerdp2-server - update to 2.11.7-150700.3.14.1
freerdp2-proxy-debuginfo - update to 2.11.7-150700.3.14.1
freerdp2 - update to 2.11.7-150700.3.14.1
freerdp2-server-debuginfo - update to 2.11.7-150700.3.14.1
freerdp2-devel - update to 2.11.7-150700.3.14.1
freerdp2-debugsource - update to 2.11.7-150700.3.14.1
freerdp2-debuginfo - update to 2.11.7-150700.3.14.1
freerdp-help - update to 2.11.8-1
freerdp - update to 2.11.8-1
freerdp-debuginfo - update to 2.11.8-1
freerdp-debugsource - update to 2.11.8-1
freerdp-devel - update to 2.11.8-1
libwinpr - update to 2.11.8-1
libwinpr-devel - update to 2.11.8-1
freerdp3 (Ubuntu package) - addressed in versions 3.5.1+dfsg1-0ubuntu1.4, 3.16.0+dfsg-2ubuntu0.3
libfreerdp-server-proxy3-3-debuginfo - update to 3.10.3-150700.3.9.1
libwinpr3-3 - update to 3.10.3-150700.3.9.1
libfreerdp3-3 - update to 3.10.3-150700.3.9.1
freerdp-sdl - update to 3.10.3-150700.3.9.1
libwinpr3-3-debuginfo - update to 3.10.3-150700.3.9.1
librdtk0-0-debuginfo - update to 3.10.3-150700.3.9.1
libfreerdp3-3-debuginfo - update to 3.10.3-150700.3.9.1
freerdp-sdl-debuginfo - update to 3.10.3-150700.3.9.1
librdtk0-0 - update to 3.10.3-150700.3.9.1
freerdp-proxy-plugins - update to 3.10.3-150700.3.9.1
freerdp-proxy-plugins-debuginfo - update to 3.10.3-150700.3.9.1
libfreerdp-server-proxy3-3 - update to 3.10.3-150700.3.9.1
freerdp - addressed in versions 3.23.0-1.fc42, 3.23.0-1.fc43, 3.23.0-1.fc44

External References

Related Security Bulletins