CVE-2026-24675: FreeRDP Use-After-Free Vulnerability

CVE-2026-24675 Overview

CVE-2026-24675 is a Use After Free vulnerability affecting FreeRDP, a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the urb_select_interface function can free the device's MS config on error, but subsequent code continues to dereference this freed memory, leading to a use after free condition in libusb_udev_select_interface. This vulnerability enables network-based attackers to cause denial of service conditions by triggering memory corruption through maliciously crafted RDP sessions.

Critical Impact

Network-accessible use after free vulnerability in FreeRDP's USB redirection subsystem can lead to denial of service through memory corruption, affecting all unpatched versions prior to 3.22.0.

Affected Products

• FreeRDP versions prior to 3.22.0
• FreeRDP USB redirection client component (libusb_udev)
• Systems utilizing FreeRDP's URBDRC (USB Redirection) channel

Discovery Timeline

• 2026-02-09 - CVE-2026-24675 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-24675

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption flaw where a program continues to use a pointer after the memory it references has been freed. In FreeRDP's USB redirection client code, the urb_select_interface function incorrectly frees the MsConfig structure when the msusb_msinterface_replace function fails. However, the calling code in libusb_udev_select_interface continues to reference this freed memory, leading to undefined behavior.

The vulnerability is network-accessible, requiring no authentication or user interaction, making it particularly concerning for exposed RDP endpoints. Successful exploitation results in high availability impact, potentially crashing the FreeRDP client or causing unexpected behavior during USB device redirection operations.

Root Cause

The root cause lies in improper memory management within the error handling path of urb_select_interface in channels/urbdrc/client/data_transfer.c. When msusb_msinterface_replace() fails, the code incorrectly called msusb_msconfig_free(MsConfig) before returning an error. Since MsConfig is obtained from pdev->get_MsConfig(pdev) and represents the device's configuration state, freeing it on a recoverable error corrupts the device state. Subsequent operations that reference the device's MS config then access freed memory.

Attack Vector

The attack vector is network-based, leveraging FreeRDP's Remote Desktop Protocol implementation. An attacker could exploit this vulnerability by:

1. Establishing an RDP connection with a target FreeRDP client
2. Initiating USB device redirection through the URBDRC channel
3. Triggering an interface selection operation that causes msusb_msinterface_replace() to fail
4. The freed MsConfig structure is then dereferenced by subsequent code, causing memory corruption

The following patch from the FreeRDP security fix demonstrates the vulnerability and its remediation:

 	MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->get_MsConfig(pdev);
 	const uint8_t InterfaceNumber = MsInterface->InterfaceNumber;
 	if (!msusb_msinterface_replace(MsConfig, InterfaceNumber, MsInterface))
-	{
-		msusb_msconfig_free(MsConfig);
 		return ERROR_BAD_CONFIGURATION;
-	}
+
 	/* complete configuration setup */
 	if (!pdev->complete_msconfig_setup(pdev, MsConfig))
 		return ERROR_BAD_CONFIGURATION;

Source: GitHub Commit Details

The patch removes the incorrect msusb_msconfig_free(MsConfig) call from the error path, ensuring the device's configuration remains valid even when interface replacement fails.

Detection Methods for CVE-2026-24675

Indicators of Compromise

• Unexpected FreeRDP client crashes during USB device redirection operations
• Memory corruption errors or segmentation faults in FreeRDP processes
• Abnormal URBDRC channel activity in RDP session logs
• Core dumps indicating use after free patterns in libusb_udev_select_interface

Detection Strategies

• Monitor FreeRDP client processes for unexpected terminations or crash patterns
• Implement memory debugging tools (AddressSanitizer, Valgrind) in development/testing environments to detect use after free conditions
• Review RDP session logs for anomalous USB redirection channel behavior
• Deploy endpoint detection solutions capable of identifying memory corruption exploitation attempts

Monitoring Recommendations

• Enable verbose logging for FreeRDP USB redirection channels to capture potential exploitation attempts
• Configure crash reporting and analysis for FreeRDP client applications
• Monitor network traffic for unusual RDP session patterns targeting USB redirection functionality
• Implement alerting on repeated FreeRDP process failures that may indicate exploitation attempts

How to Mitigate CVE-2026-24675

Immediate Actions Required

• Upgrade all FreeRDP installations to version 3.22.0 or later immediately
• If immediate patching is not possible, consider disabling USB device redirection functionality
• Review and audit systems where FreeRDP is deployed with USB redirection enabled
• Apply network segmentation to limit exposure of RDP endpoints

Patch Information

The vulnerability has been addressed in FreeRDP version 3.22.0. The security fix is available in commit d676518809c319eec15911c705c13536036af2ae. Organizations should update to the patched version as soon as possible. For detailed information, refer to the GitHub Security Advisory.

Workarounds

• Disable USB device redirection in FreeRDP client configurations if not required for business operations
• Restrict RDP connections to trusted networks and implement strict access controls
• Use application-level firewalls to filter potentially malicious RDP traffic
• Consider using alternative RDP clients until patching can be completed

# Configuration example - Disable USB redirection in FreeRDP
# Add to FreeRDP command line to disable URBDRC channel
xfreerdp /v:server.example.com /dynamic-resolution -urbdrc

# Or specify in configuration file
# ~/.config/freerdp/default.rdp
# Disable USB redirection: drivestoredirect:s: