CVE-2026-23531

Summary: CVE-2026-23531 affects FreeRDP before 3.21.0 through a flawed destination-rectangle validation in ClearCodec during RDPGFX surface updates, enabling an out-of-bounds read/write and a client-side heap buffer overflow. This can crash the client (DoS) and, depending on allocator/heap layout...

CVE-2026-23531 FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, cleardecompress calls freerdpimagecopynooverlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates...