{"id":"CVE-2026-56297","aliases":["DEBIAN-CVE-2026-56297","EUVD-2026-42255","GHSA-392f-f2j5-97qm","GHSA-3mv2-5q57-2v8h","SUSE-SU-2026:3562-1","UBUNTU-CVE-2026-56297","USN-8561-1"],"status":"published","title":"FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00466,"percentile":0.40813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2026-07-08T13:49:01Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.22.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1","3.32.1+dfsg-1","3.32.1+dfsg-1~bpo13+1","3.32.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150700.3.17.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150700.3.17.1"}]}],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0+dfsg-1ubuntu1","3.15.0+dfsg-2.1","3.16.0+dfsg-1ubuntu1","3.16.0+dfsg-2","3.16.0+dfsg-2ubuntu0.1","3.16.0+dfsg-2ubuntu0.3","3.16.0+dfsg-2ubuntu0.4","3.16.0+dfsg-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"],"bundled":34}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56297","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-392f-f2j5-97qm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56297.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56297","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263562-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258939","tags":["report"]},{"url":"https://bugzilla.suse.com/1261196","tags":["report"]},{"url":"https://bugzilla.suse.com/1261198","tags":["report"]},{"url":"https://bugzilla.suse.com/1261200","tags":["report"]},{"url":"https://bugzilla.suse.com/1261211","tags":["report"]},{"url":"https://bugzilla.suse.com/1261217","tags":["report"]},{"url":"https://bugzilla.suse.com/1261222","tags":["report"]},{"url":"https://bugzilla.suse.com/1261223","tags":["report"]},{"url":"https://bugzilla.suse.com/1261226","tags":["report"]},{"url":"https://bugzilla.suse.com/1261227","tags":["report"]},{"url":"https://bugzilla.suse.com/1262743","tags":["report"]},{"url":"https://bugzilla.suse.com/1266317","tags":["report"]},{"url":"https://bugzilla.suse.com/1267008","tags":["report"]},{"url":"https://bugzilla.suse.com/1267009","tags":["report"]},{"url":"https://bugzilla.suse.com/1267010","tags":["report"]},{"url":"https://bugzilla.suse.com/1267011","tags":["report"]},{"url":"https://bugzilla.suse.com/1271071","tags":["report"]},{"url":"https://bugzilla.suse.com/1271303","tags":["report"]},{"url":"https://bugzilla.suse.com/1271304","tags":["report"]},{"url":"https://bugzilla.suse.com/1271305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57158","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56297","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8561-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57158","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-56297","title":"FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T13:49:01.343Z","modified":"2026-07-08T14:23:00.749Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-42255","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T13:49:01Z","modified":"2026-07-08T14:23:00Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:10.578977Z"}],"ghsa":[{"id":"GHSA-392f-f2j5-97qm","title":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and...","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T15:32:00Z","modified":"2026-07-08T15:32:07Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:09:20.268554Z"}],"nvd":[{"id":"CVE-2026-56297","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T14:17:16.36Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-56297","title":"FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T13:49:01.343Z","modified":"2026-10-28T02:30:33.268778161Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"DEBIAN-CVE-2026-56297","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T14:17:16.36Z","modified":"2026-10-26T12:02:37.155945649Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56297","description":"FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.","status":"published","published":"2026-07-08T14:17:00Z","modified":"2026-07-21T13:10:19.499088133Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"SUSE-SU-2026:3562-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2026-27951: 32-bit system denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939).\n- CVE-2026-33952: client denial of service via unvalidated authentication length field (bsc#1261196).\n- CVE-2026-33977: client denial of service via malformed IMA ADPCM audio data (bsc#1261198).\n- CVE-2026-33982: heap buffer overread in `winpr_aligned_offset_recalloc()` can lead to undefined behavior\n  (bsc#1261222).\n- CVE-2026-33983: improper error handling can lead to use of incorrect shift exponent, undefined behavior and an 80\n  billion iteration loop (bsc#1261200).\n- CVE-2026-33984: heap buffer overflow allows arbitrary code execution via crafted pixel data (bsc#1261211).\n- CVE-2026-33985: heap out-of-bounds read can leak sensitive data when pixel data is rendered to screen (bsc#1261217).\n- CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).\n- CVE-2026-33987: heap out-of-bounds write due to persistent cache `bmpSize` desync (bsc#1261226).\n- CVE-2026-33995: double-free in `kerberos_AcceptSecurityContext()` and `kerberos_InitializeSecurityContextA()` can\n  lead to crash during NLA connection teardown with a failed authentication attempt (bsc#1261227).\n- CVE-2026-40033: heap buffer overflow in `gdi_CacheToSurface` allows attackers to cause a denial of service or achieve\n  remote code execution (bsc#1266317).\n- CVE-2026-40254: off-by-one error in `contains_dotdot()` allows for drive channel path traversal (bsc#1262743).\n- CVE-2026-44420: heap buffer overwrite can be triggered in server-side clipboard channel when a malicious client sends\n  a `CB_CLIP_CAPS` PDU with a too-small `capabilitySetLength` (bsc#1267008).\n- CVE-2026-44421: improper validation in `gdi_CacheToSurface` can lead to a heap buffer overwrite client when an RDP\n  server sends crafted RDPGFX PDUs (bsc#1267009).\n- CVE-2026-44422: improper memory management can lead to heap use-after-free/double-free in a client's RDPEAR\n  authentication-redirection path (bsc#1267010).\n- CVE-2026-45700: data check bypass when decoding RLE planar data can lead to an out-of-bounds heap write\n  (bsc#1267011).\n- CVE-2026-56297: improper synchronization of `channel_callback` access can lead to use-after-free in\n  `dvcman_channel_close` and `dvcman_call_on_receive` triggered by a malicious RDP server (bsc#1271071).\n- CVE-2026-57156: integer overflow in `update_read_delta_points` allows malicious RDP peers to cause a heap buffer\n  overflow (bsc#1271303).\n- CVE-2026-57157: 2-byte heap out-of-bounds read via attacker-supplied MS-RDPECAM `DeviceName` and `VirtualChannelName`\n  fields (bsc#1271304).\n- CVE-2026-57158: incomplete fix for CVE-2026-23530 in `planar_decompress_plane_rle_only` allows a malicious RDP server\n  to trigger a one byte buffer overflow via a truncated `RDPGFX_CMDID_WIRETOSURFACE_1` planar payload (bsc#1271305).\n","status":"published","published":"2026-08-10T18:16:39Z","modified":"2026-08-12T10:45:04.866306661Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8561-1","title":"freerdp3 vulnerabilities","description":"It was discovered that FreeRDP contained multiple security issues. An\nattacker could possibly use these issues to obtain sensitive information,\ncause FreeRDP to crash, resulting in a denial of service, or execute\narbitrary code.","status":"published","published":"2026-07-20T11:49:26Z","modified":"2026-10-01T00:17:47.242027428Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}