CVE-2026-22857: FreeRDP has a heap-use-after-free in irp_thread_func
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irpthreadfunc because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22857?
CVE-2026-22857 is classified with a high severity rating due to its potential to cause heap corruption and exploitation.
How do I fix CVE-2026-22857?
To fix CVE-2026-22857, upgrade FreeRDP to version 3.20.1 or later, where the vulnerability has been addressed.
What impact does CVE-2026-22857 have on FreeRDP users?
CVE-2026-22857 can allow an attacker to exploit the vulnerability leading to unexpected application behavior or potential remote code execution.
Which versions of FreeRDP are affected by CVE-2026-22857?
FreeRDP versions prior to 3.20.1 are affected by CVE-2026-22857.
Is CVE-2026-22857 specific to any operating systems?
CVE-2026-22857 affects FreeRDP regardless of the operating system, as it is a software-level vulnerability.