CVE-2026-24491
CVE-2026-24491 · FreeRDP has a heap-use-after-free in video_timer
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.
CVSS 7.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
freerdp
- Versions
- < 3.22.0: Affected
No fix published
freerdp2 Debian:12
- Versions
- 2.10.0+dfsg1-1
- 2.10.0+dfsg1-1.1
- 2.11.2+dfsg1-1
- 2.11.2+dfsg1-1.1~exp1
- 2.11.2+dfsg1-1.1~exp2
- 2.11.5+dfsg1-1
- 2.11.7+dfsg1-1
- 2.11.7+dfsg1-2
- 2.11.7+dfsg1-3
- 2.11.7+dfsg1-4
- 2.11.7+dfsg1-5
- 2.11.7+dfsg1-6
- 2.11.7+dfsg1-6~deb12u1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freerdp3 Debian:13
- Versions
- 3.15.0+dfsg-2.1
- Affected ranges
- ECOSYSTEM: < 3.15.0+dfsg-2.1+deb13u1
Update to 3.15.0+dfsg-2.1+deb13u1
freerdp3 Debian:14
- Versions
- 3.15.0+dfsg-2.1
- 3.16.0+dfsg-1
- 3.16.0+dfsg-2
- 3.17.0+dfsg-1
- 3.17.1+dfsg-1
- 3.17.1+dfsg-2
- 3.17.2+dfsg-1
- 3.17.2+dfsg-2
- 3.17.2+dfsg-3
- 3.18.0+dfsg-1
- 3.19.0+dfsg-1
- 3.19.1+dfsg-1
- 3.20.0+dfsg-1
- 3.20.2+dfsg-1
- 3.21.0+dfsg-1
- 3.22.0+dfsg-1~bpo13+0
- 3.22.0+dfsg-1~bpo13+1
- Affected ranges
- ECOSYSTEM: < 3.22.0+dfsg-1
Update to 3.22.0+dfsg-1
freerdp3 Ubuntu:24.04:LTS
- Versions
- 3.4.0+dfsg1-0ubuntu2
- 3.4.0+dfsg1-0ubuntu3
- 3.4.0+dfsg1-0ubuntu4
- 3.5.0+dfsg1-0ubuntu1
- 3.5.1+dfsg1-0ubuntu1
- 3.5.1+dfsg1-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 3.5.1+dfsg1-0ubuntu1.2
Update to 3.5.1+dfsg1-0ubuntu1.2
freerdp3 Ubuntu:25.10
- Versions
- 3.14.0+dfsg-1ubuntu1
- 3.15.0+dfsg-2.1
- 3.16.0+dfsg-1ubuntu1
- 3.16.0+dfsg-2
- Affected ranges
- ECOSYSTEM: < 3.16.0+dfsg-2ubuntu0.1
Update to 3.16.0+dfsg-2ubuntu0.1