CVE-2026-24680

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.

• CVE-2026-23948: fix missing NULL check in core/info
• CVE-2026-24491: reset channel_callback before close in drdynvc
• CVE-2026-24676: reset audin->format in channels/audin
• CVE-2026-24680: reset pointer after memory release in Wayland client
• CVE-2026-24681: cancel all USB transfers on channel close in urbdrc
• CVE-2026-24684: terminate rdpsnd thread before free

FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle. (CVE-2026-23530) FreeRDP has heap-buffer-overflow in clear_decompress. (CVE-2026-23531) FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface. (CVE-2026-23532) FreeRDP has heap-buffer-overflow in clear_decompress_residual_data. (CVE-2026-23533) FreeRDP has heap-buffer-overflow in clear_decompress_bands_data. (CVE-2026-23534) FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2(). (CVE-2026-23948) FreeRDP has a heap-use-after-free in video_timer. (CVE-2026-24491) FreeRDP has a Heap-use-after-free in urb_select_interface. (CVE-2026-24675) FreeRDP has a heap-use-after-free in audio_format_compatible. (CVE-2026-24676) FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264. (CVE-2026-24677) FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread. (CVE-2026-24678) FreeRDP has a heap-buffer-overflow in urb_select_interface. (CVE-2026-24679) FreeRDP has a heap-use-after-free in update_pointer_new(SDL). (CVE-2026-24680) FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb. (CVE-2026-24681) FreeRDP has a Heap-buffer-overflow in audio_formats_free. (CVE-2026-24682) FreeRDP has a heap-use-after-free in ainput_send_input_event. (CVE-2026-24683) FreeRDP has a Heap-use-after-free in play_thread. (CVE-2026-24684)

These are all security issues fixed in the freerdp-3.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

Update to version 3.22.0 (jsc#PED-15526):

• Major bugfix release:

  • Complete overhaul of SDL client
  • Introduction of new WINPR_ATTR_NODISCARD macro wrapping compiler or C language version specific [[nodiscard]] attributes
  • Addition of WINPR_ATTR_NODISCARD to (some) public API functions so usage errors are producing warnings now
  • Add some more stringify functions for logging
  • We've received CVE reports, check https://github.com/FreeRDP/FreeRDP/security/advisories for more details! @Keryer reported an issue affecting client and proxy:
    • CVE-2026-23948 @ehdgks0627 did some more fuzzying and found quite a number of client side bugs.
    • CVE-2026-24682
    • CVE-2026-24683
    • CVE-2026-24676
    • CVE-2026-24677
    • CVE-2026-24678
    • CVE-2026-24684
    • CVE-2026-24679
    • CVE-2026-24681
    • CVE-2026-24675
    • CVE-2026-24491
    • CVE-2026-24680

• Changes from version 3.21.0

  • [core,info] fix missing NULL check (#12157)
  • [gateway,tsg] fix TSG_PACKET_RESPONSE parsing (#12161)
  • Allow querying auth identity with kerberos when running as a server (#12162)
  • Sspi krb heimdal (#12163)
  • Tsg fix idleTimeout parsing (#12167)
  • [channels,smartcard] revert 649f7de (#12166)
  • [crypto] deprecate er and der modules (#12170)
  • [channels,rdpei] lock full update, not only parts (#12175)
  • [winpr,platform] add WINPR_ATTR_NODISCARD macro (#12178)
  • Wlog cleanup (#12179)
  • new stringify functions & touch API defines (#12180)
  • Add support for querying SECPKG_ATTR_PACKAGE_INFO to NTLM and Kerberos (#12171)
  • [channels,video] measure times in ns (#12184)
  • [utils] Nodiscard (#12187)
  • Error handling fixes (#12186)
  • [channels,drdynvc] check pointer before reset (#12189)
  • Winpr api def (#12190)
  • [winpr,platform] drop C23 [[nodiscard]] (#12192)
  • [gdi] add additional checks for a valid rdpGdi (#12194)
  • Sdl3 high dpiv2 (#12173)
  • peer: Disconnect if Logon() returned FALSE (#12196)
  • [channels,rdpecam] fix PROPERTY_DESCRIPTION parsing (#12197)
  • [channel,rdpsnd] only clean up thread before free (#12199)
  • [channels,rdpei] add RDPINPUT_CONTACT_FLAG_UP (#12195)

• Update to version 3.21.0:

  • Bugfix release with a few new API functions addressing shortcomings with regard to input data validation. Thanks to @ehdgks0627 we have fixed the following additional (medium) client side vulnerabilities:

    • CVE-2026-23530
    • CVE-2026-23531
    • CVE-2026-23532
    • CVE-2026-23533
    • CVE-2026-23534
    • CVE-2026-23732
    • CVE-2026-23883
    • CVE-2026-23884

• Changes from version 3.20.2

  • [client,sdl] fix monitor resolution (#12142)
  • [codec,progressive] fix progressive_rfx_upgrade_block (#12143)
  • Krb cache fix (#12145)
  • Rdpdr improved checks (#12141)
  • Codec advanced length checks (#12146)
  • Glyph fix length checks (#12151)
  • Wlog printf format string checks (#12150)
  • [warnings,format] fix format string warnings (#12152)
  • Double free fixes (#12153)
  • [clang-tidy] clean up code warnings (#12154)

• Update to version 3.20.2:

  • Patch release fixing a regression with gateway connections introduced with 3.20.1

    What's Changed

    • Warnings and missing enumeration types (#12137)

• Changes from version 3.20.1:

  • New years cleanup release. Fixes some issues reported and does a cleaning sweep to bring down warnings. Thanks to @ehdgks0627 doing some code review/testing we've uncovered the following (medium) vulnerabilities:

    • CVE-2026-22851
    • CVE-2026-22852
    • CVE-2026-22853
    • CVE-2026-22854
    • CVE-2026-22855
    • CVE-2026-22856
    • CVE-2026-22857
    • CVE-2026-22858
    • CVE-2026-22859

  • These affect FreeRDP based clients only, with the exception of CVE-2026-22858 also affecting FreeRDP proxy. FreeRDP based servers are not affected.

• Update to version 3.20.0:

  *…

This update for freerdp fixes the following issues:

• CVE-2026-24491: heap-use-after-free in video_timer (bsc#1257981).
• CVE-2026-24675: heap-use-after-free in urb_select_interface (bsc#1257982).
• CVE-2026-24676: heap-use-after-free in audio_format_compatible (bsc#1257983).
• CVE-2026-24677: heap-buffer-overflow in ecam_encoder_compress_h264 (bsc#1257984).
• CVE-2026-24678: heap-use-after-free in cam_v4l_stream_capture_thread (bsc#1257985).
• CVE-2026-24679: heap-buffer-overflow in urb_select_interface (bsc#1257986).
• CVE-2026-24680: heap-use-after-free in update_pointer_new(SDL) (bsc#1257987).
• CVE-2026-24681: heap-use-after-free in urb_bulk_transfer_cb (bsc#1257988).
• CVE-2026-24682: heap-buffer-overflow in audio_formats_free (bsc#1257989).
• CVE-2026-24683: heap-use-after-free in ainput_send_input_event (bsc#1257990).
• CVE-2026-24684: heap-use-after-free in play_thread (bsc#1257991).

It was discovered that FreeRDP incorrectly handled memory under certain circumstances, which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-23948)

It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24491)

It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-24675, CVE-2026-24679, CVE-2026-24682)

It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2026-24676, CVE-2026-24681)

It was discovered that FreeRDP did not correctly validate the size of certain variables, which could cause a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-24677)

It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-24678)

It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24680)

It was discovered that FreeRDP had a use after free vulnerability under certain circumstances. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24683, CVE-2026-24684)