CVE-2026-25942

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function xf rail server execute result indexes the global error code names[] array with an unchecked value, execResult->execResult, received from the server. This allows for a read outside the bounds of the array when the server sends a value of 7 or greater for execResult. The error code names[] array has 7 elements, with valid indices ranging from 0 to 6.

Recommendations Update to version 3.23.0 or later.