FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdpUpgrade libwinprUpgrade libwinpr-devel | Oct 22, 2026 | May 29, 2026 |
| Redhat_linux | — | Upgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-serverNo solution existsUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp | Jul 9, 2026 | May 29, 2026 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfo | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade libfreerdp3-3Upgrade freerdp3-x11Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub