FreeRDP Client Use-After-Free Vulnerability (CVE-2026-23883) Security Advisory: Remote Code Execution and DoS Risk

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-23883) is a Use-After-Free (UAF) flaw residing in the X11 client graphics processing implementation of FreeRDP, an open-source Remote Desktop Protocol client.

Specifically, within client/X11/xf_graphics.c, the xf_Pointer_New function frees the cursorPixels memory allocation upon encountering a failure. However, during subsequent error handling, pointer_free is invoked, which triggers xf_Pointer_Free and attempts to free the same cursorPixels pointer again. This double-free behavior results in an AddressSanitizer (ASan) detected Use-After-Free condition.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by setting up a rogue RDP server or compromising an existing trusted RDP host.

When a vulnerable FreeRDP client connects to this malicious server, the server transmits crafted pointer graphics data designed to trigger a failure inside xf_Pointer_New. Once the initial free of cursorPixels occurs, the client's cleanup routine executes xf_Pointer_Free, attempting to release the already freed memory address. Depending on the heap allocator's behavior and layout, an attacker can groom the heap to overwrite the freed memory block, potentially hijacking the control flow to execute arbitrary code under the context of the client process.

3. Infrastructure & Business Impact

FreeRDP is widely integrated into Linux thin clients, virtual desktop infrastructure (VDI) endpoints, and remote administration tools.

A successful compromise of a client endpoint via a malicious RDP session bypasses traditional perimeter defenses. This allows attackers to establish an initial foothold on the client machine, steal local credentials, and perform lateral movement within the internal corporate network, posing a severe threat to enterprise security.