Junglewise Threat Intelligence

CVE-2026-23884: FreeRDP use after free in GDI offscreen bitmap deletion

CVE-2026-23884 · Severity: critical · CVSS 9.8 · Published 2026-01-19

Technologies: Red Hat Enterprise Linux AppStream, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A vulnerability in how the software handles image data (bitmaps) could allow a malicious server to crash a user's connection or potentially execute unauthorized code on the user's computer. This risk is present when a user connects to a compromised or untrusted remote server using an affected version of the FreeRDP client.

Technical details

A use-after-free (UAF) vulnerability exists in FreeRDP's GDI component due to improper pointer management during offscreen bitmap deletion. Specifically, the 'CREATE_OFFSCREEN_BITMAP' order can delete an existing bitmap via 'deleteList', which calls 'offscreen_cache_delete' and frees the 'rdpBitmap' object. However, the 'gdi->drawing' pointer is not updated and remains pointing to the freed memory. When a subsequent primary order with 'ORDER_BOUNDS' arrives, 'gdi_set_bounds' dereferences the dangling 'gdi->drawing->hdc' pointer. An attacker controlling a malicious RDP server can trigger this UAF to cause a crash or heap corruption, potentially leading to arbitrary code execution. The issue is fixed in version 3.21.0.

Affected products

  • FreeRDP FreeRDP < 3.21.0
  • Red Hat Red Hat Enterprise Linux Server (v. 7 ELS) 7
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8) 8
  • Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10

Timeline

  • 2026-01-19: advisory: GitHub Security Advisory GHSA-cfgj-vc84-f3pp published
  • 2026-01-19: patched: FreeRDP version 3.21.0 released

References

Related threats