CVE-2026-23883
Use-After-Free in FreeRDP Pointer Handling Causes DoS, Potential RCE
Publication date: 2026-01-19
Last updated on: 2026-01-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freerdp | freerdp | to 3.21.0 (exc) |
| freerdp | freerdp | to 3.20.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) bug in FreeRDP versions prior to 3.21.0. It occurs in the handling of pointer (cursor) image data in the X11 client code. Specifically, when the function xf_Pointer_New fails to copy cursor image data, it frees the memory allocated for cursorPixels. However, the caller function then frees the same memory again, causing a double free and use-after-free condition. This can lead to a client crash (denial of service) or heap corruption, with a potential risk of code execution depending on memory allocator behavior and heap layout. A malicious RDP server can exploit this vulnerability to compromise the client. [3]
How can this vulnerability impact me? :
This vulnerability can be exploited by a malicious RDP server to cause the FreeRDP client to crash, resulting in a denial of service (DoS). Additionally, it may lead to heap corruption that could allow an attacker to execute arbitrary code on the client system, depending on the memory allocator behavior and heap layout. Therefore, it poses a risk of both service disruption and potential remote code execution. [3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a client-side use-after-free triggered by a malicious RDP server during pointer update handling. Detection would involve monitoring FreeRDP client crashes or AddressSanitizer (ASan) reports indicating use-after-free errors related to cursorPixels memory. Running FreeRDP with ASan enabled can help detect this issue. There are no specific network commands provided to detect this vulnerability directly. Monitoring for crashes or abnormal behavior in FreeRDP clients connecting to untrusted servers is advised. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade FreeRDP to version 3.21.0 or later, where the issue has been patched. Avoid connecting to untrusted or malicious RDP servers until the update is applied. Additionally, running FreeRDP with memory error detection tools like AddressSanitizer can help identify exploitation attempts during testing. [3]