CVE-2026-23884: FreeRDP Use-After-Free Vulnerability

CVE-2026-23884 Overview

CVE-2026-23884 is a Use-After-Free vulnerability affecting FreeRDP, a widely-used open source implementation of the Remote Desktop Protocol (RDP). The vulnerability exists in how the FreeRDP client handles offscreen bitmap deletion, where the gdi->drawing pointer is left pointing to freed memory. When related update packets arrive after the bitmap has been deleted, the client attempts to access this freed memory, resulting in a use-after-free condition.

This client-side vulnerability can be triggered by a malicious RDP server, allowing an attacker to cause denial of service through application crashes. More critically, depending on the memory allocator behavior and surrounding heap layout, this vulnerability may lead to heap corruption with potential remote code execution implications.

Critical Impact

A malicious RDP server can exploit this use-after-free vulnerability to crash FreeRDP clients (DoS) and potentially achieve remote code execution through heap corruption.

Affected Products

• FreeRDP versions prior to 3.21.0
• Applications and systems using vulnerable FreeRDP libraries
• Linux, Windows, and macOS systems running affected FreeRDP clients

Discovery Timeline

• 2026-01-19 - CVE-2026-23884 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23884

Vulnerability Analysis

The vulnerability is classified under CWE-416 (Use After Free) and resides in the offscreen bitmap caching mechanism within FreeRDP's GDI subsystem. The core issue occurs in the libfreerdp/cache/offscreen.c file where bitmap deletion operations fail to properly invalidate the gdi->drawing pointer after freeing the associated memory.

When an offscreen bitmap is deleted from the cache, the memory associated with that bitmap is freed. However, if gdi->drawing was pointing to this bitmap at the time of deletion, the pointer continues to reference the now-freed memory location. Subsequently, when the FreeRDP client processes related update packets that reference the drawing surface, the code attempts to access memory through this dangling pointer.

This memory access pattern creates a classic use-after-free scenario. The exploitability depends significantly on heap implementation characteristics—specifically, whether the freed memory has been reallocated for other purposes between the free operation and the subsequent access. In favorable conditions for an attacker, this could enable controlled data to be written to or read from the freed memory region, potentially leading to arbitrary code execution.

Root Cause

The root cause is improper memory management in the offscreen bitmap cache handling. When deleting an offscreen bitmap, the code fails to check whether gdi->drawing points to the bitmap being deleted and does not nullify or redirect this pointer to a valid drawing surface. This leaves a dangling pointer that can be dereferenced when processing subsequent RDP protocol messages.

The vulnerable code paths are located in the offscreen cache implementation at libfreerdp/cache/offscreen.c, specifically around lines 87-91 and 114-122 where bitmap deletion and drawing surface management occur.

Attack Vector

The attack requires a victim to connect to a malicious RDP server controlled by the attacker. The attack proceeds as follows:

1. The victim's FreeRDP client connects to the attacker-controlled RDP server
2. The malicious server sends crafted RDP protocol messages that cause an offscreen bitmap to be created and set as the current drawing surface
3. The server then sends a message triggering deletion of this offscreen bitmap, freeing the memory while gdi->drawing still references it
4. Finally, the server sends update packets that cause the client to access the freed memory through the dangling gdi->drawing pointer
5. This results in a crash (DoS) and potentially arbitrary code execution if the heap layout is favorable

The vulnerability is exploited over the network with no authentication required from the attacker's perspective—the victim simply needs to initiate a connection to the malicious server.

Detection Methods for CVE-2026-23884

Indicators of Compromise

• Unexpected FreeRDP client crashes during RDP sessions, particularly with SIGSEGV or memory access violations
• Core dumps showing crashes in offscreen bitmap or GDI-related functions
• Network traffic showing unusual sequences of offscreen bitmap create/delete operations followed by drawing commands
• Heap corruption detection alerts from memory sanitizers or security tools during FreeRDP execution

Detection Strategies

• Monitor for FreeRDP process crashes and collect crash dumps for analysis, specifically looking for crashes in offscreen.c or GDI subsystem code
• Deploy endpoint detection tools that can identify memory corruption patterns in FreeRDP processes
• Use network intrusion detection systems to flag suspicious RDP traffic patterns from untrusted servers
• Enable AddressSanitizer or similar memory debugging tools in development and testing environments to catch use-after-free conditions

Monitoring Recommendations

• Implement logging of all outbound RDP connections to external or untrusted servers
• Configure endpoint protection solutions to monitor FreeRDP binary execution and detect abnormal memory access patterns
• Establish alerts for repeated FreeRDP crashes that may indicate exploitation attempts
• Review network security policies to restrict RDP client connections to trusted server destinations only

How to Mitigate CVE-2026-23884

Immediate Actions Required

• Upgrade FreeRDP to version 3.21.0 or later immediately on all affected systems
• Audit systems for FreeRDP installations and prioritize patching for internet-facing or high-risk endpoints
• Restrict FreeRDP connections to trusted, authenticated RDP servers only
• Consider temporarily disabling FreeRDP functionality if immediate patching is not possible

Patch Information

FreeRDP version 3.21.0 contains the official fix for this vulnerability. The patch properly handles the gdi->drawing pointer during offscreen bitmap deletion to prevent the dangling pointer condition. Users should upgrade to this version or later by obtaining the release from the official FreeRDP releases page.

For detailed information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-cfgj-vc84-f3pp.

Workarounds

• Implement network segmentation to prevent FreeRDP clients from connecting to untrusted RDP servers
• Use firewall rules to whitelist approved RDP server destinations and block connections to unknown hosts
• Deploy application control policies that restrict FreeRDP usage to authorized users and use cases
• Configure VPN requirements for all remote desktop connections to reduce exposure to malicious servers