Skip to content
OpenAdvisories
High USN-8042-1 12 CVEs

freerdp2, freerdp3 vulnerabilities

Published Feb 16, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FreeRDP incorrectly handled memory under certain
circumstances, which could lead to a NULL pointer dereference. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-23948)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu
25.10. (CVE-2026-24491)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-24675, CVE-2026-24679, CVE-2026-24682)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2026-24676,
CVE-2026-24681)

It was discovered that FreeRDP did not correctly validate the size of
certain variables, which could cause a buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 25.10. (CVE-2026-24677)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
Ubuntu 25.10. (CVE-2026-24678)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
FreeRDP3 in Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-24680)

It was discovered that FreeRDP had a use after free vulnerability under
certain circumstances. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2026-24683, CVE-2026-24684)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS freerdp2 2.6.1+dfsg1-3ubuntu2.10
Ubuntu · 24.04 LTS 24.04:LTS freerdp3 3.5.1+dfsg1-0ubuntu1.2
Ubuntu · 25.10 freerdp3 3.16.0+dfsg-2ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS freerdp2 2.2.0+dfsg1-0ubuntu0.18.04.4+esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS freerdp2 2.6.1+dfsg1-0ubuntu0.20.04.2+esm3
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS freerdp2 2.11.5+dfsg1-1ubuntu0.1~esm5

Vulnerabilities 12

  • High 8.7
    CVE-2026-24677

    FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. This vulnerability is…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24678

    FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fix…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24679

    FreeRDP has a heap-buffer-overflow in urb_select_interface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerabilit…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24680

    FreeRDP has a heap-use-after-free in update_pointer_new(SDL)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24681

    FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is f…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24682

    FreeRDP has a Heap-buffer-overflow in audio_formats_free

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24683

    FreeRDP has a heap-use-after-free in ainput_send_input_event

    FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-24684

    FreeRDP has a Heap-use-after-free in play_thread

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerab…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24491

    FreeRDP has a heap-use-after-free in video_timer

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.2…

    FreeRDP FreeRDP freerdp2 freerdp3 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24675

    FreeRDP has a Heap-use-after-free in urb_select_interface

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerabili…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • High 7.7
    CVE-2026-24676

    FreeRDP has a heap-use-after-free in audio_format_compatible

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vuln…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2026-23948

    FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cb…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-23948
  • report
    https://ubuntu.com/security/CVE-2026-24491
  • report
    https://ubuntu.com/security/CVE-2026-24675
  • report
    https://ubuntu.com/security/CVE-2026-24676
  • report
    https://ubuntu.com/security/CVE-2026-24677
  • report
    https://ubuntu.com/security/CVE-2026-24678
  • report
    https://ubuntu.com/security/CVE-2026-24679
  • report
    https://ubuntu.com/security/CVE-2026-24680
  • report
    https://ubuntu.com/security/CVE-2026-24681
  • report
    https://ubuntu.com/security/CVE-2026-24682
  • report
    https://ubuntu.com/security/CVE-2026-24683
  • report
    https://ubuntu.com/security/CVE-2026-24684