Fiche vulnérabilité
CVE-2026-22859 : faille critique freerdp freerdp (CVSS 9.1)
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
En bref
- Sévérité
- Critique (CVSS 9.1)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Exploitation active
- Non signalée par la CISA
- Publication
- 14 janv. 2026
- Dernière mise à jour
- 15 juil. 2026
Produits concernés
- freerdp freerdp
Références
- Fiche CVE-2026-22859 sur le NVD (NIST)
- github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA…
- access.redhat.com/errata/RHSA-2026:19033
- access.redhat.com/errata/RHSA-2026:3067
- access.redhat.com/errata/RHSA-2026:3068
- access.redhat.com/errata/RHSA-2026:3334
- access.redhat.com/errata/RHSA-2026:3975
- access.redhat.com/errata/RHSA-2026:4121
- access.redhat.com/errata/RHSA-2026:4433
- access.redhat.com/errata/RHSA-2026:4437
- access.redhat.com/errata/RHSA-2026:4438
- access.redhat.com/errata/RHSA-2026:4439
- access.redhat.com/errata/RHSA-2026:4440
- access.redhat.com/errata/RHSA-2026:4446
- access.redhat.com/errata/RHSA-2026:4471