CVE-2026-23883
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In FreeRDP prior to version 3.21.0, the `xf_Pointer_New` function frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` which frees it again, triggering an ASan-detected use-after-free. A malicious server can trigger a client-side use after free, causing a crash (DoS) and potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout.
Risk Assessment
The risk includes remote client crash (DoS) and, under favorable conditions, heap corruption that could lead to arbitrary code execution by a malicious RDP server.
Recommendation
Immediately upgrade FreeRDP to version 3.21.0 or later, which contains the fix for the double-free vulnerability.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.