FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-devel | Oct 27, 2026 | Oct 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-develUpgrade libwinpr | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdp-debuginfo | Sep 30, 2026 | Sep 15, 2026 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdpUpgrade libwinpr | Oct 22, 2026 | Sep 15, 2026 |
| Redhat_linux | — | Upgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-develNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdp-serverUpgrade libwinpr-develUpgrade freerdp-libs-debuginfo | Sep 17, 2026 | Sep 15, 2026 |
| Rocky_linux | — | Upgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade libwinpr-devel | Oct 8, 2026 | Oct 6, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Sep 22, 2026 | Sep 16, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub