CVE-2026-24680
published 2026-02-09CVE-2026-24680: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
34.3th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.23.0+dfsg-1 (forky) | freerdp3 3.23.0+dfsg-1 (forky) |
| debian | freerdp2 | < freerdp3 3.22.0+dfsg-1 (forky) | freerdp3 3.22.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.23.0+dfsg-1 (forky) | freerdp3 3.23.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.22.0+dfsg-1 (forky) | freerdp3 3.22.0+dfsg-1 (forky) |
| freerdp | freerdp | < 3.23.0 | 3.23.0 |
| freerdp | freerdp | < 3.23.0 | 3.23.0 |
| freerdp | freerdp | < 3.22.0 | 3.22.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_debian8.7HIGH
vendor_redhat8.7HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FreeRDP up to 3.21.x sdl_Pointer_New use after free (GHSA-j893-9wg8-33rc / Nessus ID 299346)
vuldb·2026-06-10·CVSS 7.5
CVE-2026-24680 [HIGH] FreeRDP up to 3.21.x sdl_Pointer_New use after free (GHSA-j893-9wg8-33rc / Nessus ID 299346)
A vulnerability described as critical has been identified in FreeRDP up to 3.21.x. Affected is the function sdl_Pointer_New. Such manipulation leads to use after free.
This vulnerability is traded as CVE-2026-24680. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
OSV
CVE-2026-27950: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-02-25·CVSS 8.7
CVE-2026-27950 [HIGH] CVE-2026-27950: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
OSV
freerdp2, freerdp3 vulnerabilities
osv·2026-02-16·CVSS 6.9
CVE-2026-23948 [MEDIUM] freerdp2, freerdp3 vulnerabilities
freerdp2, freerdp3 vulnerabilities
It was discovered that FreeRDP incorrectly handled memory under certain
circumstances, which could lead to a NULL pointer dereference. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-23948)
It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu
25.10. (CVE-2026-24491)
It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (
OSV
CVE-2026-24680: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-02-09·CVSS 8.7
CVE-2026-24680 [HIGH] CVE-2026-24680: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Red Hat
freerdp: FreeRDP: Denial of service due to incomplete fix for heap-use-after-free vulnerability
vendor_redhat·2026-02-25·CVSS 8.7
CVE-2026-27950 [HIGH] CWE-825 freerdp: FreeRDP: Denial of service due to incomplete fix for heap-use-after-free vulnerability
freerdp: FreeRDP: Denial of service due to incomplete fix for heap-use-after-free vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
A flaw was found in FreeRDP. An incomplete fix for a heap-use-after-free vulnerability (
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-02-16·CVSS 7.5
CVE-2026-23948 [HIGH] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled memory under certain
circumstances, which could lead to a NULL pointer dereference. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-23948)
It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu
25.10. (CVE-2026-24491)
It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to c
Red Hat
freerdp: FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
vendor_redhat·2026-02-09·CVSS 8.7
CVE-2026-24680 [HIGH] CWE-825 freerdp: FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
freerdp: FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
A heap buffer use after free has been discovered in FreeRDP. sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering a program crash.
Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease o
Debian
CVE-2026-27950: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
vendor_debian·2026·CVSS 8.7
CVE-2026-27950 [HIGH] CVE-2026-27950: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
Scope: local
bookworm: resolved
bullseye: resolved
Debian
CVE-2026-24680: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0...
vendor_debian·2026·CVSS 8.7
CVE-2026-24680 [HIGH] CVE-2026-24680: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Scope: local
bookworm: open
bullseye: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-24680 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-24680 [HIGH] CVE-2026-24680 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-24680 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Source : NVD
## 8.7
Score
Published February 9, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
NixOS
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
freerdp-debugsource
freerdp-libs
Sources
NVD
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22 Severity HIGH Ha
Wiz
CVE-2026-27950 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-27950 [HIGH] CVE-2026-27950 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27950 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
Source : NVD
## 5.5
Score
Published February 25, 2026
Severity MEDIUM
CNA Score 5.5
Affected Technologies
NixO
2026-02-09
Published