FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverNo solution existsUpgrade freerdp-devel | Jul 9, 2026 | May 29, 2026 |
| Rocky_linux | — | Upgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade freerdp-x11Upgrade libfreerdp3-3Upgrade freerdp3-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub