CVE-2026-22858

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22858.json

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896

https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1

https://bugzilla.redhat.com/show_bug.cgi?id=2429649

https://access.redhat.com/security/cve/CVE-2026-22858

https://access.redhat.com/errata/RHSA-2026:4489

https://access.redhat.com/errata/RHSA-2026:4471

https://access.redhat.com/errata/RHSA-2026:4446

https://access.redhat.com/errata/RHSA-2026:4440

https://access.redhat.com/errata/RHSA-2026:4439

https://access.redhat.com/errata/RHSA-2026:4438

https://access.redhat.com/errata/RHSA-2026:4437

https://access.redhat.com/errata/RHSA-2026:4433

https://access.redhat.com/errata/RHSA-2026:4121

https://access.redhat.com/errata/RHSA-2026:3975

https://access.redhat.com/errata/RHSA-2026:3334

https://access.redhat.com/errata/RHSA-2026:3068

https://access.redhat.com/errata/RHSA-2026:3067

https://access.redhat.com/errata/RHSA-2026:19033

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS