FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl->primary (SDL_Surface) is accessed after it has been freed during RDPGFX ResetGraphics handling. This vulnerability is fixed in 3.20.1.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Feb 10, 2026 | Jan 14, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-server | Feb 20, 2026 | Jan 14, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jan 14, 2026 |
| Suse | — | Upgrade libfreerdp3-3Upgrade freerdp-develUpgrade freerdp-proxy-pluginsUpgrade libuwac0-0Upgrade freerdp-serverUpgrade rdtk0-develUpgrade uwac0-develUpgrade freerdpUpgrade winpr-develUpgrade librdtk0-0Upgrade libfreerdp-server-proxy3-3Upgrade freerdp-waylandUpgrade libwinpr3-3Upgrade freerdp-sdlUpgrade freerdp-proxy | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Jan 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub