High severity7.5NVD Advisory· Published Feb 9, 2026· Updated Jun 17, 2026

CVE-2026-24684

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Freerdp/Freerdp3 versions
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*range: <3.22.0
- (no CPE)range: <3.22.0
- (no CPE)range: < 3.22.0
osv-coords17 versions
pkg:rpm/almalinux/freerdp pkg:rpm/almalinux/freerdp-devel pkg:rpm/almalinux/freerdp-libs pkg:rpm/almalinux/freerdp-server pkg:rpm/almalinux/libwinpr pkg:rpm/almalinux/libwinpr-devel pkg:rpm/opensuse/freerdp&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/freerdp&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/freerdp&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/freerdp2&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/freerdp2&distro=openSUSE%20Tumbleweed pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7 pkg:rpm/suse/freerdp2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/freerdp2&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7
< 2:2.11.7-1.el9_7.5+ 16 more
- (no CPE)range: < 2:2.11.7-1.el9_7.5
- (no CPE)range: < 2:2.11.7-1.el9_7.5
- (no CPE)range: < 2:2.11.7-1.el9_7.5
- (no CPE)range: < 2:3.10.3-5.el10_1.5
- (no CPE)range: < 2:2.11.7-1.el9_7.5
- (no CPE)range: < 2:2.11.7-1.el9_7.5
- (no CPE)range: < 2.11.2-150600.4.9.1
- (no CPE)range: < 3.22.0-160000.1.1
- (no CPE)range: < 3.22.0-1.1
- (no CPE)range: < 2.11.7-bp160.2.1
- (no CPE)range: < 2.11.7-5.1
- (no CPE)range: < 2.11.2-150600.4.9.1
- (no CPE)range: < 2.1.2-12.57.1
- (no CPE)range: < 2.1.2-12.57.1
- (no CPE)range: < 3.10.3-150700.3.6.1
- (no CPE)range: < 2.11.7-150700.3.8.1
- (no CPE)range: < 2.11.7-150700.3.8.1

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696nvdPatch
github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5nvdPatch
github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcgv-xgjp-h83qnvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000