UBUNTU-CVE-2026-22853
- Source
- https://ubuntu.com/security/CVE-2026-22853
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22853.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-22853
- Upstream
- Downstream
- Related
- Published
- 2026-01-14T18:16:00Z
- Modified
- 2026-03-19T08:44:14.603955Z
- Severity
-
- 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndrreaduint8Array. This vulnerability is fixed in 3.20.1.
- References
Affected packages
Ubuntu:25.10 / freerdp3
Package
- Name
- freerdp3
- Purl
- pkg:deb/ubuntu/freerdp3@3.16.0+dfsg-2ubuntu0.3?arch=source&distro=questing
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.16.0+dfsg-2ubuntu0.3
Affected versions
3.*
3.14.0+dfsg-1ubuntu1
3.15.0+dfsg-2.1
3.16.0+dfsg-1ubuntu1
3.16.0+dfsg-2
3.16.0+dfsg-2ubuntu0.1
Ecosystem specific
{
"binaries": [
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-dev"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-proxy"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-proxy-modules"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-sdl"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-shadow-x11"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-wayland"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "freerdp3-x11"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp-client3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp-server-proxy3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp-server3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp-shadow-subsystem3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp-shadow3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libfreerdp3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libwinpr-tools3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libwinpr3-3"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "libwinpr3-dev"
},
{
"binary_version": "3.16.0+dfsg-2ubuntu0.3",
"binary_name": "winpr3-utils"
}
],
"availability": "No subscription required"
}