CVE-2026-25941
📋 TL;DR
FreeRDP clients have an out-of-bounds read vulnerability in the RDPGFX channel that allows malicious RDP servers to read uninitialized heap memory. This can lead to information disclosure or client crashes when users connect to compromised servers. All FreeRDP client users on affected versions are at risk.
💻 Affected Systems
- FreeRDP
📦 What is this software?
Freerdp by Freerdp
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information disclosure from client memory, potentially including credentials or session data, leading to client crashes and denial of service.
Likely Case
Information disclosure of uninitialized heap memory, potentially revealing fragments of sensitive data, with possible client crashes disrupting RDP sessions.
If Mitigated
Limited impact with proper network segmentation and server trust controls, potentially only causing client crashes without data exposure.
🎯 Exploit Status
Exploitation requires the client to connect to a malicious server. No authentication bypass needed as the attack occurs during normal RDP session establishment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.8 for 2.x branch, 3.23.0 for 3.x branch
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8
Restart Required: Yes
Instructions:
1. Update FreeRDP to version 2.11.8 or higher if using 2.x branch. 2. Update FreeRDP to version 3.23.0 or higher if using 3.x branch. 3. Restart any running FreeRDP client processes.
🔧 Temporary Workarounds
Disable RDPGFX channel
allDisable the RDPGFX channel which contains the vulnerable component
freerdp /gfx:off /v:server
Restrict RDP connections
allOnly allow FreeRDP connections to trusted, verified RDP servers
🧯 If You Can't Patch
- Implement network segmentation to restrict FreeRDP client access to trusted RDP servers only
- Monitor for abnormal RDP connection attempts and client crashes
🔍 How to Verify
Check if Vulnerable:
Check FreeRDP version with 'xfreerdp --version' or equivalent command for your platformCheck Version:
xfreerdp --versionVerify Fix Applied:
Verify version is 2.11.8 or higher (2.x branch) or 3.23.0 or higher (3.x branch)📡 Detection & Monitoring
Log Indicators:
- FreeRDP client crashes during RDP connection establishment
- Abnormal memory access errors in system logs
Network Indicators:
- RDP connections to untrusted or unknown servers
- Abnormal RDPGFX channel traffic patterns
SIEM Query:
source="freerdp" AND (event="crash" OR event="error") AND process="xfreerdp"