Security readout for executives and security teams
Plain-English summary
A malicious RDP server can attack vulnerable FreeRDP clients before 3.26.0 when RDPGFX is enabled. The flaw can corrupt client memory, causing crashes and potentially code execution on the user’s machine.
Executive priority
Treat as high priority for workstations and jump hosts using FreeRDP. The business risk is client compromise after connecting to a hostile RDP server, not unauthenticated compromise of an RDP server.
Technical view
In FreeRDP gdi_CacheToSurface, destination rectangle validation uses a UINT16_MAX-clamped rectangle, but the copy uses the original cacheEntry width and height. Crafted RDPGFX PDUs from a malicious server can trigger a heap out-of-bounds write. CVSS is 8.8 high.
Likely exposure
Systems using FreeRDP clients older than 3.26.0 are exposed when RDPGFX is enabled, especially users connecting to untrusted, third-party, or potentially compromised RDP servers.
Exploitation context
The supplied sources do not state active exploitation, and KEV is false. Exploitation requires user interaction: the vulnerable client must connect to a malicious RDP server that sends crafted RDPGFX traffic.
Researcher notes
Focus review on FreeRDP RDPGFX CacheToSurface handling and the clamped-rectangle versus original-dimension mismatch. Source evidence supports crash and potential code execution, but does not provide confirmed exploitation in the wild.
Mitigation direction
- Upgrade FreeRDP to 3.26.0 or a vendor-fixed package.
- Prioritize users who connect to external or untrusted RDP servers.
- Disable RDPGFX where it is not operationally required.
- Check Red Hat or distribution guidance for package-specific remediation.
Validation and detection
- Inventory FreeRDP client versions and flag anything below 3.26.0.
- Review client configuration for RDPGFX enablement.
- Confirm vendor package advisories map to CVE-2026-44421.
- Verify patched clients report FreeRDP 3.26.0 or vendor-fixed builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-44421 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-29T21:01:24.644Z: Reported to Red Hat.
- 2026-05-29T19:40:25.492Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ffCVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44421CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2483471CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44421.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:36203CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.