{"id":"CVE-2026-27950","aliases":["DEBIAN-CVE-2026-27950","EUVD-2026-8754","GHSA-rvfg-86cr-5r6p","SUSE-SU-2026:1633-1","UBUNTU-CVE-2026-27950","USN-8105-1"],"status":"published","title":"FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00496,"percentile":0.43092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-02-25T21:05:23Z","modified":"2026-10-28T11:09:59Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.23.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.5.1+dfsg1-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"freerdp3","fixed_in":["3.16.0+dfsg-2ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1","3.32.1+dfsg-1","3.32.1+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.23.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-0ubuntu1.2"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0+dfsg-2ubuntu0.3"}]}],"versions":["3.14.0+dfsg-1ubuntu1","3.15.0+dfsg-2.1","3.16.0+dfsg-1ubuntu1","3.16.0+dfsg-2","3.16.0+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-0ubuntu1.4"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2"],"bundled":32},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0+dfsg-2ubuntu0.3"}]}],"versions":["3.14.0+dfsg-1ubuntu1","3.15.0+dfsg-2.1","3.16.0+dfsg-1ubuntu1","3.16.0+dfsg-2","3.16.0+dfsg-2ubuntu0.1"],"bundled":32}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rvfg-86cr-5r6p","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/5f62aa11c1bdf00f94c40ea9ebb260a752740b80","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/c42ecbd183b001e76bfc3614cddfad0034acc758","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/blob/master/client/SDL/SDL2/sdl_pointer.cpp#L63-L64","tags":["x_refsource_MISC","Product","web","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27950.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27950","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27950","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261633-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258919","tags":["report"]},{"url":"https://bugzilla.suse.com/1258920","tags":["report"]},{"url":"https://bugzilla.suse.com/1258921","tags":["report"]},{"url":"https://bugzilla.suse.com/1258923","tags":["report"]},{"url":"https://bugzilla.suse.com/1258924","tags":["report"]},{"url":"https://bugzilla.suse.com/1258939","tags":["report"]},{"url":"https://bugzilla.suse.com/1258941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258967","tags":["report"]},{"url":"https://bugzilla.suse.com/1258973","tags":["report"]},{"url":"https://bugzilla.suse.com/1258976","tags":["report"]},{"url":"https://bugzilla.suse.com/1258977","tags":["report"]},{"url":"https://bugzilla.suse.com/1258987","tags":["report"]},{"url":"https://bugzilla.suse.com/1259680","tags":["report"]},{"url":"https://bugzilla.suse.com/1259684","tags":["report"]},{"url":"https://bugzilla.suse.com/1259689","tags":["report"]},{"url":"https://bugzilla.suse.com/1259692","tags":["report"]},{"url":"https://bugzilla.suse.com/1259693","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31897","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27950","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27950","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8105-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-26271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-26955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-26965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-26986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27951","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-27950","title":"FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T21:05:23.581Z","modified":"2026-02-26T20:38:07.068Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-8754","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T21:05:23Z","modified":"2026-02-26T20:38:07Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:14.049749Z"}],"nvd":[{"id":"CVE-2026-27950","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T22:16:27.297Z","modified":"2026-06-17T10:27:57.81Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-27950","title":"FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T21:05:23.581Z","modified":"2026-11-11T13:30:32.298483611Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"DEBIAN-CVE-2026-27950","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T22:16:27.297Z","modified":"2026-10-01T03:03:02.245093955Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"UBUNTU-CVE-2026-27950","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.","status":"published","published":"2026-02-25T22:16:00Z","modified":"2026-06-16T13:30:45.01085973Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"SUSE-SU-2026:1633-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted `WIRE_TO_SURFACE_2` PDU (bsc#1258919).\n- CVE-2026-25942: Global-buffer-overflow in `xf_rail_server_execute_result` (bsc#1258920).\n- CVE-2026-25952: Heap-use-after-free in `xf_SetWindowMinMaxInfo` (bsc#1258921).\n- CVE-2026-25953: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258923).\n- CVE-2026-25954: Heap-use-after-free in `xf_rail_server_local_move_size` (bsc#1258924).\n- CVE-2026-25955: Heap-use-after-free in `xf_AppUpdateWindowFromSurface` (bsc#1258973).\n- CVE-2026-25959: Heap-use-after-free in `xf_cliprdr_provide_data_` (bsc#1258976).\n- CVE-2026-25997: Heap-use-after-free in `xf_clipboard_format_equal` (bsc#1258977).\n- CVE-2026-26986: Heap-use-after-free in `rail_window_free` (bsc#1258967).\n- CVE-2026-27015: Smartcard NDR alignment padding triggers reachable `WINPR_ASSERT` abort (bsc#1258987).\n- CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).\n- CVE-2026-27951: Denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).\n- CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).\n- CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).\n- CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).\n- CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).\n","status":"published","published":"2026-04-27T12:05:30Z","modified":"2026-04-28T08:00:19.590001Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-8105-1","title":"freerdp3 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled certain RDP packets. A\nremote attacker could use this issue to cause FreeRDP to crash, resulting\nin a denial of service, or possibly execute arbitrary code.","status":"published","published":"2026-03-18T12:03:18Z","modified":"2026-10-27T04:16:54.424890397Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}