CVE-2026-23884
Published: 19 January 2026
Summary
CVE-2026-23884 is a high-severity Use After Free (CWE-416) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 41.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23884 is a use-after-free (UAF) vulnerability (CWE-416) in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). In versions prior to 3.21.0, the offscreen bitmap deletion logic in the cache module improperly leaves a pointer (`gdi->drawing`) dangling to freed memory. Subsequent arrival of related update packets triggers the UAF during client-side processing, as detailed in the affected code at libfreerdp/cache/offscreen.c lines 114-122 and 87-91.
A remote attacker controlling a malicious RDP server can exploit this against FreeRDP clients connecting to it over the network, with no privileges, user interaction, or special conditions required (CVSS 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation reliably causes a client crash for denial-of-service (DoS), and may enable heap corruption leading to arbitrary code execution depending on the memory allocator's behavior and heap layout at the time.
The FreeRDP security advisory (GHSA-cfgj-vc84-f3pp) and release notes for version 3.21.0 confirm a patch addressing the dangling pointer issue. Security practitioners should upgrade FreeRDP clients to 3.21.0 or later and audit deployments for vulnerable versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3310
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free,…
more
causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UAF in FreeRDP client exploited by malicious RDP server enables remote code execution (T1203) via heap corruption and reliable client crash for DoS (T1499.004) with no user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability by requiring timely patching of FreeRDP to version 3.21.0 or later.
Provides memory protection mechanisms that specifically address use-after-free errors, mitigating heap corruption and potential code execution from offscreen bitmap processing.
Enables identification of vulnerable FreeRDP versions through vulnerability scanning, facilitating remediation before exploitation by malicious RDP servers.