CVE-2026-25941: FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read

Published Feb 25, 2026
·
Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRETOSURFACE2 PDU with a bitmapDataLength value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.

Affected Software

3 affected components
FreeRDP freerdp<2.11.8, <3.23.0
FreeRDP freerdp>=2.0.0<2.11.8
FreeRDP freerdp>=3.0.0<3.23.0

Event History

Feb 25, 2026
CVE Published
via MITRE·07:55 PM
Data Sourced
via MITRE·07:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:23 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-25941?

CVE-2026-25941 has been classified as a medium severity vulnerability due to the potential for unauthorized information disclosure.

2

How do I fix CVE-2026-25941?

To fix CVE-2026-25941, users should upgrade FreeRDP to version 2.11.8 or 3.23.0 or later.

3

What versions of FreeRDP are affected by CVE-2026-25941?

FreeRDP versions prior to 2.11.8 on the 2.x branch and prior to 3.23.0 on the 3.x branch are affected by CVE-2026-25941.

4

What type of vulnerability is CVE-2026-25941?

CVE-2026-25941 is identified as an out-of-bounds read vulnerability that may lead to information leakage.

5

Is user data at risk with CVE-2026-25941?

Yes, CVE-2026-25941 may expose sensitive user data due to the out-of-bounds read in the RDPGFX channel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203