FreeRDP Remote Desktop Client Use-After-Free (UAF) Vulnerability (CVE-2026-23884) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTFreeRDP client libraries and dependent applications prior to version 3.21.0
Remote Code Execution (RCE) or Denial of Service (DoS) on the client side when connecting to a malicious RDP server
Immediately upgrade FreeRDP to the patched version 3.21.0 or higher
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update FreeRDP to version 3.21.0 or later using your system package manager or by compiling from the official source.
# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade freerdp2-x11 freerdp3-x11 libfreerdp-client3-3
# For RedHat/CentOS/Rocky Linux-based systems
sudo dnf clean all
sudo dnf upgrade freerdp2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict outbound RDP connections to trusted networks only.
# Block outbound RDP (Port 3389) to untrusted external networks using iptables
sudo iptables -A OUTPUT -p tcp --dport 3389 -j DROP
# Allow outbound RDP only to trusted internal subnets (e.g., 10.0.0.0/8)
sudo iptables -I OUTPUT -p tcp -d 10.0.0.0/8 --dport 3389 -j ACCEPT3. Log Audit & IoC Verification Commands
Use the following script to check the installed FreeRDP version and determine if it is vulnerable.
# Script to verify the installed FreeRDP version
INSTALLED_VER=$(xfreerdp --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)
REQUIRED_VER='3.21.0'
if [ -z "$INSTALLED_VER" ]; then
echo '[!] FreeRDP is not installed or version could not be detected.'
else
echo "[*] Installed FreeRDP version: $INSTALLED_VER"
if [ "$(printf '%s\
%s' "$REQUIRED_VER" "$INSTALLED_VER" | sort -V | head -n1)" = "$REQUIRED_VER" ]; then
echo '[+] Version is secure.'
else
echo '[-] Vulnerable version detected! Immediate upgrade required.'
fi
fiBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-23884) is a Use-After-Free (UAF) flaw in FreeRDP, a free implementation of the Remote Desktop Protocol. The root cause lies within the offscreen bitmap deletion logic in libfreerdp/cache/offscreen.c. When an offscreen bitmap is deleted, the global GDI context pointer gdi->drawing is left pointing to the freed memory block instead of being safely set to NULL.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by setting up a rogue RDP server or compromising an existing one, then enticing a vulnerable FreeRDP client to connect. The malicious server sends specific offscreen bitmap deletion commands to trigger the deallocation of the memory pointed to by gdi->drawing. When subsequent update packets arrive, the client attempts to access and write to this dangling pointer. Depending on the heap layout and memory allocator behavior, this leads to heap corruption, potentially allowing arbitrary code execution or causing a client crash (DoS).
3. Infrastructure & Business Impact
FreeRDP is widely integrated into Linux distributions, macOS clients, and thin-client infrastructures to access Windows environments and VDI systems. A successful exploit allows an untrusted external server to compromise the connecting client machine. This bypasses perimeter defenses and can serve as an initial entry point for lateral movement within corporate networks, posing a severe threat to enterprise security.
Official Vendor Advisories & References
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Frequently Asked SecOps Questions (CVE-2026-23884)
FAQQ1. How critical is CVE-2026-23884 and is it actively exploited in the wild?
CVE-2026-23884 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-23884?
Primary impacted vendors include freerdp across freerdp. Scope summary: All FreeRDP versions prior to 3.21.0 (Fixed in 3.21.0)
Q3. What temporary mitigations or workarounds exist for CVE-2026-23884 before patching?
[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-23884
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (freerdp)
View Category →Google Chrome Dawn Use-After-Free Vulnerability (CVE-2026-5281) Technical Advisory
[Affected Scope] Google Chrome versions prior to 146.0.7680.178
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.