CVE-2026-22857

FreeRDP has a heap-use-after-free in irp_thread_func

Published Jan 14, 2026 CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.

Analysis

Technical impact

A heap use‑after‑free occurs in FreeRDP’s irp_thread_func when an IRP object is freed and then accessed again along an error path. This flaw can potentially lead to memory corruption if the error path is triggered. The weakness is identified as CWE‑416.

Affected Systems

All installations of FreeRDP older than release 3.20.1 are affected.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of less than 1 % indicates a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploiting the flaw would require an attacker to trigger the error path after the IRP has been freed, which would need access to the RDP service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

affected

Version	Status	Constraints
`< 3.20.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Freerdp	Freerdp	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FreeRDP to version 3.20.1 or later to apply the fix for the heap use‑after‑free flaw.
If an upgrade cannot be performed immediately, restrict RDP traffic to trusted networks or disable the RDP service from untrusted networks to reduce exposure.
Monitor system logs for anomalous RDP activity that may indicate an attempt to exploit the flaw.

Generated by OpenCVE AI on April 18, 2026 at 19:13 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8105-1	FreeRDP vulnerabilities

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.527% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8
https://nvd.nist.gov/vuln/detail/CVE-2026-22857
https://www.cve.org/CVERecord?id=CVE-2026-22857

History

Jan 20, 2026 6:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Metrics	cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Jan 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-22857 https://www.cve.org/CVERecord?id=CVE-2026-22857
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}` threat_severity `Moderate`

Jan 15, 2026 8:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Freerdp Freerdp freerdp
Vendors & Products		Freerdp Freerdp freerdp

Jan 14, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 14, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.
Title		FreeRDP has a heap-use-after-free in irp_thread_func
Weaknesses		CWE-416
References		https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8
Metrics		cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}`