CVE-2026-24682: FreeRDP Use-After-Free Vulnerability

CVE-2026-24682 Overview

CVE-2026-24682 is a heap-based memory corruption vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the audin_server_recv_formats function, which frees an incorrect number of audio formats when parsing fails. The faulty counter expression (i + i) causes audio_formats_free to perform out-of-bounds access on the format array. The issue affects all FreeRDP versions prior to 3.22.0 and is exploitable over the network without authentication or user interaction. The vulnerability is classified under [CWE-122] Heap-based Buffer Overflow.

Critical Impact
Remote, unauthenticated attackers can trigger out-of-bounds memory access in FreeRDP server-side audio input handling, leading to denial of service through process crash.

Affected Products

FreeRDP versions prior to 3.22.0
Applications and distributions embedding vulnerable FreeRDP libraries
RDP server implementations using the audin channel with FreeRDP

Discovery Timeline

2026-02-09 - CVE-2026-24682 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-24682

Vulnerability Analysis

FreeRDP implements the Remote Desktop Protocol audio input (audin) channel to relay client microphone data to a server. The server-side handler audin_server_recv_formats parses a list of audio format descriptors received from the peer. When parsing of one or more format entries fails partway through the loop, the cleanup path frees previously allocated entries before propagating the error.

The cleanup logic uses an incorrect index expression (i + i) instead of i when computing the count of formats to free. This causes audio_formats_free to iterate beyond the bounds of the allocated format array and dereference uninitialized or out-of-bounds heap memory.

Because the audin channel is reachable as part of RDP virtual channel negotiation, an unauthenticated client can send malformed format descriptors to trigger the faulty cleanup path. The result is out-of-bounds heap access, leading to memory corruption and process termination.

Root Cause

The root cause is an arithmetic error in error-handling code. The function passes i + i rather than i to audio_formats_free, doubling the iteration count over a partially populated array. This produces a [CWE-122] heap-based out-of-bounds read and free pattern when parsing fails on any but the first entry.

Attack Vector

A remote attacker connects to a FreeRDP-based server and negotiates the audin dynamic virtual channel. The attacker sends a crafted Format List PDU containing audio format descriptors structured to fail mid-parse. The error path invokes audio_formats_free with the doubled count, accessing unallocated heap memory. No authentication or user interaction is required.

The vulnerability affects availability of the FreeRDP server process. See the GitHub Security Advisory GHSA-vcw2-pqgw-mx6g and the upstream fix commit for technical details.

Detection Methods for CVE-2026-24682

Indicators of Compromise

Unexpected crashes or segmentation faults in FreeRDP server processes correlated with inbound RDP sessions
Core dumps referencing audin_server_recv_formats or audio_formats_free in the call stack
Repeated short-lived RDP connections from a single source that terminate during channel negotiation

Detection Strategies

Inventory hosts and applications shipping FreeRDP libraries and confirm versions against 3.22.0
Inspect RDP virtual channel traffic for malformed Format List PDU messages targeting the audin channel
Correlate process termination events for FreeRDP-based services with preceding network connections on TCP/3389

Monitoring Recommendations

Enable verbose logging on FreeRDP-based services to capture channel negotiation failures
Monitor for repeated crash-restart cycles of RDP server processes that may indicate exploitation attempts
Alert on RDP connections from untrusted networks to internet-exposed FreeRDP-based services

How to Mitigate CVE-2026-24682

Immediate Actions Required

Upgrade FreeRDP to version 3.22.0 or later on all affected systems
Identify downstream applications and Linux distribution packages that bundle FreeRDP and apply vendor updates
Restrict network exposure of FreeRDP-based RDP servers to trusted management networks only

Patch Information

The vulnerability is fixed in FreeRDP 3.22.0. The corrective change replaces the i + i argument with the correct entry count in the error-handling path of audin_server_recv_formats. Refer to the FreeRDP fix commit 1c5c7422 for the source-level change.

Workarounds

Disable the audin dynamic virtual channel on FreeRDP server deployments where audio input is not required
Place FreeRDP-based services behind an authenticated RDP gateway or VPN to prevent unauthenticated network reachability
Apply network ACLs to limit inbound RDP traffic to known administrative source addresses

bash

# Verify installed FreeRDP version and update via package manager
xfreerdp --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Fedora/RHEL
sudo dnf upgrade freerdp

# Build from source at the fixed release
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP && git checkout 3.22.0