CVE-2026-24676: FreeRDP Use After Free Vulnerability

CVE-2026-24676 Overview

CVE-2026-24676 is a use-after-free vulnerability [CWE-416] in FreeRDP, the open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the audio input (AUDIN) channel handling, where format renegotiation frees the active format list while the capture thread continues to reference audin->format. The dangling pointer is later dereferenced inside audio_format_compatible, producing a use-after-free condition. All FreeRDP releases prior to 3.22.0 are affected. The issue is network-reachable and requires no authentication or user interaction, impacting availability of FreeRDP clients and downstream applications that embed the library.

Critical Impact
Remote attackers can trigger a use-after-free in the AUDIN capture path, causing process crashes and potential memory corruption in any application linking FreeRDP versions prior to 3.22.0.

Affected Products

FreeRDP versions prior to 3.22.0
Applications and distributions embedding vulnerable FreeRDP libraries (for example xfreerdp, wlfreerdp)
Remote desktop clients and thin-client products that bundle FreeRDP for RDP connectivity

Discovery Timeline

2026-02-09 - CVE-2026-24676 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-24676

Vulnerability Analysis

The AUDIN dynamic virtual channel in FreeRDP negotiates audio capture formats with the RDP server at session start and again whenever the server requests a format change. During renegotiation, FreeRDP frees the previously allocated format list and replaces it with the new server-supplied list. The capture thread runs concurrently and continues to read audin->format, which references entries inside the freed list. When audio_format_compatible is invoked on this stale pointer, the process reads and compares freed heap memory.

The consequence is undefined behavior ranging from crashes to potential heap layout manipulation. Because FreeRDP clients typically initiate sessions against attacker-controlled or compromised servers, the malicious peer drives the renegotiation timing required to win the race against the capture thread.

Root Cause

The root cause is missing synchronization between the AUDIN format-negotiation handler and the audio capture thread. The negotiation handler releases the active format list without atomically updating audin->format or coordinating with the consumer thread through a lock, reference count, or read-copy-update pattern. The fix in commit 026b81ae5831ac1598d8f7371e0d0996fac7db00 (released in 3.22.0) corrects the lifetime management of the format list.

Attack Vector

A malicious or compromised RDP server sends AUDIN format-change PDUs to a connected FreeRDP client at a moment when the capture thread is executing audio_format_compatible. The capture thread dereferences freed memory, producing a use-after-free. No credentials or user interaction are required beyond the client establishing an RDP session to the attacker-controlled endpoint, which is a routine outbound action for remote desktop users.

No public proof-of-concept code is available. Readers should consult the FreeRDP Security Advisory GHSA-qh5p-frq4-pgxj and the upstream patch commit for technical specifics of the format-list lifetime fix.

Detection Methods for CVE-2026-24676

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in FreeRDP-based clients (xfreerdp, wlfreerdp) or applications linking libfreerdp shortly after connecting to a remote server.
Core dumps showing faulting frames inside audio_format_compatible or the AUDIN channel handler.
Outbound RDP (TCP/3389) sessions from user workstations to untrusted or unexpected destinations.

Detection Strategies

Inventory endpoints and Linux/Unix workstations for installed FreeRDP versions using package managers (dpkg -l | grep freerdp, rpm -qa | grep freerdp) and flag any release below 3.22.0.
Monitor application crash telemetry and Linux coredumpctl or systemd-coredump events that reference FreeRDP binaries or libraries.
Inspect AUDIN channel traffic in network captures for abnormal frequency of format-change PDUs originating from RDP servers.

Monitoring Recommendations

Enable EDR process-crash and exception telemetry on hosts that run RDP client software, and alert on repeated faults in libfreerdp*.so.
Log outbound RDP connections at the firewall or proxy and review destinations against approved remote-access targets.
Track FreeRDP package versions through configuration management or vulnerability scanners and prioritize hosts running pre-3.22.0 builds.

How to Mitigate CVE-2026-24676

Immediate Actions Required

Upgrade FreeRDP to version 3.22.0 or later on all clients and any application bundling the library.
Restrict outbound RDP from user workstations to a vetted list of corporate RDP gateways and brokers.
Audit third-party software that statically links or vendors FreeRDP and request patched builds from vendors.

Patch Information

The vulnerability is fixed in FreeRDP 3.22.0. The corrective change is upstream commit 026b81ae5831ac1598d8f7371e0d0996fac7db00, which addresses the format-list lifetime so the capture thread no longer dereferences freed memory. Linux distributions are expected to backport the fix; verify that the installed package version reflects the patch. Refer to GHSA-qh5p-frq4-pgxj for the vendor advisory.

Workarounds

Disable the AUDIN audio-input redirection in client configurations where audio capture is not required, for example by omitting /audio-mode and /microphone flags in xfreerdp invocations.
Limit RDP sessions to trusted, internally managed servers until patched FreeRDP builds are deployed.
Apply network egress controls so that endpoints can only initiate RDP to known corporate brokers, reducing exposure to malicious servers.

bash

# Verify installed FreeRDP version and disable AUDIN as a temporary workaround
xfreerdp --version

# Connect without microphone/audio input redirection (AUDIN channel)
xfreerdp /v:rdp.example.corp /u:alice /cert:tofu
# Note: omit /microphone and avoid /audio-mode:1 to keep AUDIN inactive