CVE-2026-24684: FreeRDP has a Heap-use-after-free in play_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsndtreatwave. This vulnerability is fixed in 3.22.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24684?
CVE-2026-24684 has been classified as a critical severity vulnerability due to its potential to allow exploitation leading to arbitrary code execution.
How do I fix CVE-2026-24684?
To fix CVE-2026-24684, users should upgrade to FreeRDP version 3.22.0 or later to mitigate the heap-use-after-free vulnerability.
What is the impact of CVE-2026-24684 on FreeRDP?
The impact of CVE-2026-24684 on FreeRDP could lead to denial of service or execution of arbitrary code via exploitation of the async playback thread.
Which versions of FreeRDP are affected by CVE-2026-24684?
FreeRDP versions prior to 3.22.0 are affected by CVE-2026-24684, making it crucial for users to update.
Is there any workaround for CVE-2026-24684?
There are no effective workarounds for CVE-2026-24684; the only solution is to upgrade to the patched version.