Executive brief
FreeRDP is a widely-used open-source implementation of the Remote Desktop Protocol that allows secure access to remote systems. A use-after-free vulnerability in the dynamic virtual channel parser allows authenticated attackers to crash the FreeRDP server or potentially execute arbitrary code by racing channel closure messages against data parsing operations, exploiting a synchronization flaw that leaves freed memory accessible.
Technical details
The vulnerability is a use-after-free in the DRDYNVC (Dynamic RDP Virtual Channel) parser in libfreerdp/core/server.c. The wts_get_dvc_channel_by_id() function retrieves a channel pointer from a synchronized hash table but releases the table lock before returning, creating a window where the channel can be freed by a concurrent close operation. An authenticated client can race an AUDIN channel closure message against DRDYNVC data parsing to cause the parser thread to dereference the freed rdpPeerChannel object, triggering a heap-use-after-free. The defect affects all versions from 2.0.0 through 3.30.0. Exploitation requires the FreeRDP server to have a dynamic virtual channel (such as AUDIN) enabled whose worker thread can close the channel concurrently with the parser reading from it. The attack is authenticated and requires precise timing but has been confirmed to be reproducible with AddressSanitizer instrumentation.
Affected products
- FreeRDP FreeRDP 2.0.0 through 3.30.0
Timeline
- 2026-09-15: disclosed
- 2026-09-01: patched: Version 3.31.0 released with patch