CVE-2026-40254

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A rogue Remote Desktop Protocol (RDP) server can exploit an off-by-one error in the path traversal filter. This allows the server to read, list, or write files in the directory above the client's shared folder when the victim connects with drive redirection enabled. This vulnerability can lead to unauthorized information disclosure and arbitrary file modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid connecting to untrusted RDP servers with drive redirection enabled. When using xfreerdp or similar FreeRDP clients, do not use the /drive or /d command-line options to prevent sharing local drives with the remote server. Disabling drive redirection limits the attack surface by preventing the vulnerable code path from being exercised.