CVE-2026-25942

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25942
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528 Patch
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76 Patch
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017 Patch
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46 Patch
https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b Patch
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6 Exploit Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
History

27 Feb 2026, 14:54

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528 - () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L528 - Patch
References () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76 - () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/channels/rail/client/rail_orders.c#L75-L76 - Patch
References () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017 - () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L1014-L1017 - Patch
References () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46 - () https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_rail.c#L40-L46 - Patch
References () https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b - () https://github.com/FreeRDP/FreeRDP/commit/9362a0bf8dda04eedbca07d5dfaec1044e67cc6b - Patch
References () https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6 - () https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6 - Exploit, Mitigation, Patch, Vendor Advisory
First Time Freerdp
Freerdp freerdp
CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) FreeRDP es una implementación gratuita del Protocolo de Escritorio Remoto. Antes de la versión 3.23.0, 'xf_rail_server_execute_result' indexa el array global 'error_code_names[]' (7 elementos, índices 0–6) con un valor 'execResult->execResult' no verificado recibido del servidor, permitiendo una lectura fuera de límites cuando el servidor envía un valor 'execResult' de 7 o superior. La versión 3.23.0 corrige el problema.

25 Feb 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 21:16

Updated : 2026-02-27 14:54

NVD link : CVE-2026-25942

Mitre link : CVE-2026-25942

CVE.ORG link : CVE-2026-25942

JSON object : View

Products Affected

freerdp

  • freerdp
CWE
CWE-125

Out-of-bounds Read