CVE-2026-23883

Critical · CVSS 9.8

FreeRDP — Use-After-Free (UAF) in X11 cursor pointer handling leading to DoS / potential RCE

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-416, CWE-416

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Search profile — drives PoC discovery

Symbols xf_Pointer_Newxf_Pointer_Freepointer_freecursorPixelsxf_graphics.cpointer.cxf_Pointer_New failure pathGHSA-qcrr-85qx-4p6x

Keywords CVE-2026-23883FreeRDP use-after-freeFreeRDP UAF cursorPixelsxf_Pointer_New xf_Pointer_Free double freeFreeRDP GHSA-qcrr-85qx-4p6xFreeRDP 3.21.0 patchFreeRDP malicious server client crashFreeRDP heap corruption RDP client

Versions: < 3.21.0

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-06-30T18:30:14.000Z