CVE-2026-23533

CVE-2026-23533 is a critical client-side heap buffer overflow vulnerability affecting FreeRDP versions prior to 3.21.0, a free implementation of the Remote Desktop Protocol. A malicious server can exploit this flaw during the RDPGFX ClearCodec decode path, leading to out-of-bounds writes and causing a denial of service (DoS) or potentially remote code execution due to heap corruption. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community attention with 12 mentions and 2 media articles.