CVE-2026-44422: FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44422?
The severity of CVE-2026-44422 is rated as high, with a CVSS score of 7.5.
How do I fix CVE-2026-44422?
To fix CVE-2026-44422, upgrade FreeRDP to version 3.26.0 or later where the vulnerability has been addressed.
What are the main vulnerabilities associated with CVE-2026-44422?
CVE-2026-44422 is associated with Use After Free, Double Free, and type confusion vulnerabilities.
What impact does CVE-2026-44422 have on FreeRDP?
CVE-2026-44422 can lead to client-side security risks such as unauthorized access and potential system crashes.
Which versions of FreeRDP are affected by CVE-2026-44422?
FreeRDP versions prior to 3.26.0 are affected by CVE-2026-44422.