Every CVESearch/Get API key

CVE-2026-27950

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

5.5 MediumFix available

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.50%Up 0.4 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used5.5

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
CVE-2026-27950
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-87545.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
EUVD-2026-8754
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
NVD5.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
CVE-2026-27950
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV5.5

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
CVE-2026-27950
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-11
OSVDEBIAN-CVE-2026-279507.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
DEBIAN-CVE-2026-27950
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-279505.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Record
UBUNTU-CVE-2026-27950
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2026:1633-1No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: Heap-use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1633-1
Updated
2026-11-02
OSVUSN-8105-1No score

freerdp3 vulnerabilities

It was discovered that FreeRDP incorrectly handled certain RDP packets. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-8105-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp3
Debian:13
All versions, plus listed versions
3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1
Show 44 moreShow less
3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-13.32.1+dfsg-13.32.1+dfsg-1~bpo13+1
None known
freerdp3
Debian:14
before 3.23.0+dfsg-1, plus listed versions
3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1
Show 15 moreShow less
3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-1~bpo13+1
3.23.0+dfsg-1
freerdp
Ubuntu:16.04:LTS
All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
None known
freerdp2
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6
Show 14 moreShow less
2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6
None known
freerdp
Ubuntu:18.04:LTS
All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
None known
freerdp2
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1
Show 12 moreShow less
2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4
None known
freerdp2
Ubuntu:22.04:LTS
All versions, plus listed versions
2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1
Show 18 moreShow less
2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11
None known
freerdp3
Ubuntu:24.04:LTS
before 3.5.1+dfsg1-0ubuntu1.2, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1.1
3.5.1+dfsg1-0ubuntu1.2
freerdp2
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1
Show 7 moreShow less
2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6
None known
freerdp3
Ubuntu:25.10
before 3.16.0+dfsg-2ubuntu0.3, plus listed versions
3.14.0+dfsg-1ubuntu13.15.0+dfsg-2.13.16.0+dfsg-1ubuntu13.16.0+dfsg-23.16.0+dfsg-2ubuntu0.1
3.16.0+dfsg-2ubuntu0.3
freerdp3
Ubuntu:24.04:LTS
From an advisory covering 32 CVEs
before 3.5.1+dfsg1-0ubuntu1.4, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.2
3.5.1+dfsg1-0ubuntu1.4
freerdp3
Ubuntu:25.10
From an advisory covering 32 CVEs
before 3.16.0+dfsg-2ubuntu0.3, plus listed versions
3.14.0+dfsg-1ubuntu13.15.0+dfsg-2.13.16.0+dfsg-1ubuntu13.16.0+dfsg-23.16.0+dfsg-2ubuntu0.1
3.16.0+dfsg-2ubuntu0.3

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27950 is a medium vulnerability (CVSS 5.5) in Freerdp, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in freerdp3 3.23.0+dfsg-1.

References

Show 70 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open