CVE-2026-23884 — Heap-use-after-free in gdi_set_bounds

Description (CNA)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Affected (CNA)

Vendor / product	Versions
FreeRDP / FreeRDP	affected < 3.21.0

CWE

CWE-416

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit this vulnerability when a client connects to it. Specifically, offscreen bitmap deletion can lead to a use-after-free (UAF) condition, where the client attempts to use memory that has already been deallocated. This can cause a crash, resulting in a Denial of Service (DoS), and potentially lead to heap corruption with a risk of arbitrary code execution.