Junglewise Threat Intelligence

CVE-2026-24678: FreeRDP use after free in ecam_channel_write

CVE-2026-24678 · Severity: high · CVSS 7.5 · Published 2026-02-09

Technologies: FreeRDP. Vendors: FreeRDP.

Executive brief

FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A flaw in how it handles camera device channels can allow a malicious server to crash the client application. This results in a denial-of-service, potentially disrupting remote work sessions and requiring the application to be restarted.

Technical details

A use-after-free vulnerability exists in FreeRDP's camera device redirection (rdpecam) component. The root cause is a race condition where the 'ecam_dev_on_close' function frees a channel callback without properly synchronizing with the asynchronous capture thread. When the capture thread subsequently attempts to send a sample response via 'ecam_dev_send_sample_response', it calls 'ecam_channel_write' using a pointer to the already freed memory. This can be triggered by a remote RDP server closing a device channel while a camera stream is active, leading to a crash (Denial of Service). The issue is fixed in version 3.22.0 by ensuring all streams are stopped before the channel is closed.

Affected products

  • FreeRDP FreeRDP < 3.22.0

Timeline

  • 2026-02-09: disclosed
  • 2026-02-09: patched: Fixed in version 3.22.0
  • 2026-02-09: advisory

References

Related threats