CVE-2026-24680
Published: 09 February 2026
Summary
CVE-2026-24680 is a high-severity Use After Free (CWE-416) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in FreeRDP directly enables remote exploitation leading to application crash and denial of service (T1499.004).
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Deeper analysisAI
CVE-2026-24680 is a use-after-free vulnerability (CWE-416) in FreeRDP, a free implementation of the Remote Desktop Protocol. In versions prior to 3.22.0, the sdl_Pointer_New function frees data upon failure, after which pointer_free calls sdl_Pointer_Free and frees it again, triggering an AddressSanitizer (ASan)-detected use-after-free condition.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation results in high availability impact with no effects on confidentiality or integrity, as reflected in the CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), potentially causing denial of service via application crash.
The issue is fixed in FreeRDP version 3.22.0. Mitigation involves upgrading to this version or later. Details are provided in the FreeRDP GitHub security advisory at GHSA-j893-9wg8-33rc and the patching commit at c42ecbd183b001e76bfc3614cddfad0034acc758.
Details
- CWE(s)