CVE-2026-23884

Heap-use-after-free in gdi_set_bounds

View on CVE.org
Published Jan 19, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Analysis

AI-generated

Technical impact

FreeRDP clients prior to version 3.21.0 contain a heap‑use‑after‑free flaw in the offscreen bitmap deletion routine. When a client receives an update packet after a bitmap has been freed, the library continues to reference the stale pointer, causing a crash. Depending on the libc allocator behavior and surrounding heap layout, this scenario could drive heap corruption and lead to arbitrary code execution on the client system.

Affected Systems

The vulnerability affects the FreeRDP project on all installations built with versions earlier than 3.21.0. Users running 3.21.0 or later are not impacted because the patch was applied in that release.

Risk and Exploitability

The flaw receives a CVSS base score of 7.7 and an EPSS value below 1 % at the time of analysis, indicating a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. The attack surface requires a malicious RDP server to send specially crafted update packets after an offscreen bitmap has been freed; this condition is inferred from the description. Due to the far‑thest reachable remote code execution risk, timely remediation is advised.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to FreeRDP 3.21.0 or newer.
  • If upgrade is delayed, disable offscreen bitmap caching in the client configuration to avoid the freed pointer usage.
  • Monitor RDP sessions for abnormal crashes and verify the latest client version is in use.

Generated by OpenCVE AI on April 18, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8105-1 FreeRDP vulnerabilities
History
Type Values Removed Values Added
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Freerdp
Freerdp freerdp
Vendors & Products Freerdp
Freerdp freerdp
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}

threat_severity

Important
Type Values Removed Values Added
Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Title Heap-use-after-free in gdi_set_bounds
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jul 15, 2026, 1:17 AM
Reserved
Jan 16, 2026, 9:02 PM

View source JSON

Updated
Jul 15, 2026, 1:17 AM

JSON

Status
Modified
Published
Jan 19, 2026, 6:16 PM
Modified
Jul 15, 2026, 2:18 AM

View source JSON

Severity
Important
Public date
Jan 19, 2026, 5:20 PM

View source Bugzilla JSON

Updated
Apr 18, 2026, 5:15 AM

JSON