FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reconnect) frees the array while the X11 event thread concurrently iterates it in `xf_clipboard_changed`, triggering a heap use after free. Version 3.23.0 fixes the issue.
CVSS Details
- CVSS 4.0 Base Score: 5.5 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Mar 2, 2026 | Feb 25, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade libwinprUpgrade libwinpr-debuginfo | Apr 7, 2026 | Feb 25, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr | May 13, 2026 | Feb 25, 2026 |
| Redhat_linux | — | Upgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-server-debuginfoNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-devel | May 12, 2026 | Feb 25, 2026 |
| Rocky_linux | — | Upgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-serverUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-server-debuginfo | May 15, 2026 | May 13, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3 | Mar 19, 2026 | Feb 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub