CVE-2026-23884 FreeRDP CVE debrief

Who should care

Organizations and individuals using FreeRDP versions prior to 3.21.0 should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 3.21.0 or later, and ensuring that all clients and servers are patched. Additionally, defenders should monitor for potential exploitation attempts and be prepared to respond to incidents.

Technical summary

The vulnerability is caused by offscreen bitmap deletion leaving `gdi->drawing` pointing to freed memory. When related update packets arrive, this can lead to a use-after-free (UAF) condition. The vulnerability has a CVSS score of 7.7 and is classified as HIGH severity. The vulnerability can be triggered by a malicious server on the client-side, and can cause a crash (DoS) and potentially lead to heap corruption with code-execution risk.

Defensive priority

High priority should be given to patching affected systems, as the vulnerability can be triggered remotely and has a high severity score. Defenders should also monitor for potential exploitation attempts and be prepared to respond to incidents.

Recommended defensive actions

• Update to version 3.21.0 or later of FreeRDP
• Ensure all clients and servers are patched
• Monitor for potential exploitation attempts
• Be prepared to respond to incidents
• Review and update incident response plans

Evidence notes

The vulnerability was reported by an unknown source and patched in version 3.21.0 of FreeRDP. The CVE record and NVD detail provide additional information on the vulnerability. Red Hat has also provided errata for affected systems.

Official resources