Is CVE-2026-23883 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23883 being exploited in the wild.

How severe is CVE-2026-23883?

Critical severity, with a CVSS score of 9.8, published 19 January 2026.

Is there a fix for CVE-2026-23883?

A patch was published on 2026-01-19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23883 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23883?

Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23883: FreeRDP use after free in xf_Pointer_New

CVE-2026-23883 · Severity: critical · CVSS 9.8 · Published 2026-01-19

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A vulnerability in how the software handles mouse cursor data allows a malicious server to crash a user's connection or potentially take control of their computer. This could lead to service disruptions or the theft of sensitive information if a user connects to an untrusted server.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-23883 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23883 being exploited in the wild.
How severe is CVE-2026-23883?: Critical severity, with a CVSS score of 9.8, published 19 January 2026.
Which products and versions are affected?: FreeRDP < 3.21.0.
Is there a fix for CVE-2026-23883?: A patch was published on 2026-01-19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23883 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23883?: Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in FreeRDP's X11 client due to a double-free condition in the `xf_Pointer_New` function. When `freerdp_image_copy_from_pointer_data` fails, the `cursorPixels` buffer is freed; however, the subsequent error handling path in `update_pointer_color` calls `pointer_free`, which invokes `xf_Pointer_Free` and attempts to free the same buffer again. A malicious RDP server can exploit this by sending specially crafted pointer updates to a client. This can result in a denial-of-service (crash) or potentially remote code execution depending on the heap layout and allocator behavior. The issue is fixed in version 3.21.0.

Affected products

FreeRDP FreeRDP < 3.21.0

Timeline

2026-01-19: disclosed
2026-01-19: advisory
2026-01-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.