Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol used by many Linux-based remote desktop clients. A vulnerability exists where a malicious or compromised RDP server can send specifically timed messages to crash the user's client application. In some scenarios, this could potentially allow the server to gain unauthorized access to the user's system or data.
Technical details
A use-after-free vulnerability exists in FreeRDP's drdynvc client component due to improper synchronization of the channel_callback access between dvcman_channel_close and dvcman_call_on_receive. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently. This causes the close path to free the callback object while the receive path is still attempting to dispatch data through it. The vulnerability is reachable in any FreeRDP-based client (such as xfreerdp or Remmina) connecting to an adversarial server. The issue was addressed in version 3.22.0 by ensuring the callback pointer is invalidated before the object is freed.
Affected products
- FreeRDP FreeRDP < 3.22.0
Timeline
- 2026-01-26: other: Initial fix commit e02e052 authored
- 2026-05-04: advisory: GHSA-3mv2-5q57-2v8h published
- 2026-07-08: disclosed: CVE-2026-56297 published to NVD