CVE-2026-24681
Published: 09 February 2026
Summary
CVE-2026-24681 is a high-severity Use After Free (CWE-416) vulnerability in Freerdp Freerdp. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation of UAF in FreeRDP (public-facing RDP service) directly enables application DoS via crafted URBDRC traffic.
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in…
more
3.22.0.
Deeper analysisAI
CVE-2026-24681 is a use-after-free vulnerability (CWE-416) in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 3.22.0, asynchronous bulk transfer completions can invoke a freed channel callback after the URBDRC channel is closed, specifically in the urb_write_completion function. This flaw has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
Remote attackers with network access can exploit this vulnerability without authentication or user interaction by triggering the use-after-free during RDP sessions involving URBDRC channels. Successful exploitation leads to denial-of-service through application crashes, but does not enable confidentiality or integrity violations.
The vulnerability is fixed in FreeRDP version 3.22.0. The official patch is available in GitHub commit 414f701464929c217f2509bcbd6d2c1f00f7ed73, and further details are provided in the FreeRDP security advisory at GHSA-ccvv-hg2w-6x9j. Security practitioners should prioritize updating affected FreeRDP instances to mitigate this issue.
Details
- CWE(s)