CVE-2026-22857

Critical

Published: 14/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

FreeRDP before version 3.20.1 contains a use-after-free vulnerability in the irp_thread_func function. The IRP object is freed by irp->Complete() and then accessed again on the error path, potentially leading to memory corruption.

Risk Assessment

A malicious RDP server could exploit this vulnerability to crash the client or potentially execute code in the client's context, threatening data confidentiality and integrity.

Recommendation

It is recommended to immediately upgrade FreeRDP to version 3.20.1 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.