Log in Start free

Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27950FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

Medium 5.5

In plain English

A medium-severity use-after-free in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.5%top 57.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-27950
Debian:14freerdp33.23.0+dfsg-1DEBIAN-CVE-2026-27950
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-27950
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.4USN-8105-1
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.2UBUNTU-CVE-2026-27950
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3USN-8105-1
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.3UBUNTU-CVE-2026-27950

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.23.0

Weakness: CWE-416 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References