CVE-2026-24676
Published: 09 February 2026
Summary
CVE-2026-24676 is a high-severity Use After Free (CWE-416) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in FreeRDP's RDP/AUDIN handling allows unauthenticated remote network exploitation that directly crashes the application, mapping to application/system exploitation for endpoint DoS.
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed…
more
in 3.22.0.
Deeper analysisAI
CVE-2026-24676 is a use-after-free vulnerability (CWE-416) in FreeRDP, a free implementation of the Remote Desktop Protocol. The issue affects versions prior to 3.22.0 and occurs during AUDIN format renegotiation, where the active format list is freed while the capture thread continues using audin->format, leading to a use-after-free condition in the audio_format_compatible function.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low complexity, no privileges or user interaction required. An unauthenticated remote attacker can trigger the flaw by initiating a Remote Desktop Protocol connection, causing a denial of service through application crash or instability due to the memory corruption.
The vulnerability is fixed in FreeRDP version 3.22.0. The patch commit is available at https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00, and further details are provided in the GitHub security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qh5p-frq4-pgxj. Security practitioners should update to 3.22.0 or later to mitigate the issue.
Details
- CWE(s)