THREAT OPS › Threat News › [NVD] CVE-2026-22855 (CRITICAL 9.1) — FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
[NVD] CVE-2026-22855 (CRITICAL 9.1) — FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
CVE-2026-22855 CVSS: 9.1 CRITICAL Published: 2026-01-14T18:16:43.080
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
MITRE ATT&CK techniques
- Remote Desktop ProtocolT1021.001
Indicators of compromise
- CVE-2026-22855cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-22855