CVE-2026-23884: FreeRDP use after free in GDI offscreen bitmap deletion

CVE-2026-23884 · Severity: critical · CVSS 9.8 · Published 2026-01-19

FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A vulnerability in how the software handles image data (bitmaps) could allow a malicious server to crash a user's connection or potentially execute unauthorized code on the user's computer. This risk is present when a user connects to a compromised or untrusted remote server using an affected version of the FreeRDP client.

Technologies: FreeRDP, Red Hat Enterprise Linux AppStream. Vendors: FreeRDP, Red Hat.

Quick answers

Is CVE-2026-23884 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23884 being exploited in the wild.
How severe is CVE-2026-23884?
Critical severity, with a CVSS score of 9.8, published 19 January 2026.
Which products and versions are affected?
FreeRDP < 3.21.0; Red Hat Enterprise Linux AppStream 8.
Is there a fix for CVE-2026-23884?
A patch was published on 2026-01-19: FreeRDP version 3.21.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23884 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23884?
Check whether you run FreeRDP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in FreeRDP's GDI component due to improper pointer management during offscreen bitmap deletion. Specifically, the 'CREATE_OFFSCREEN_BITMAP' order can delete an existing bitmap via 'deleteList', which calls 'offscreen_cache_delete' and frees the 'rdpBitmap' object. However, the 'gdi->drawing' pointer is not updated and remains pointing to the freed memory. When a subsequent primary order with 'ORDER_BOUNDS' arrives, 'gdi_set_bounds' dereferences the dangling 'gdi->drawing->hdc' pointer. An attacker controlling a malicious RDP server can trigger this UAF to cause a crash or heap corruption, potentially leading to arbitrary code execution. The issue is fixed in version 3.21.0.

Affected products

  • FreeRDP FreeRDP < 3.21.0
  • Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) 7
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8) 8
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10

Timeline

  • 2026-01-19: advisory: GitHub Security Advisory GHSA-cfgj-vc84-f3pp published
  • 2026-01-19: patched: FreeRDP version 3.21.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.