CVE-2026-27950mediumCWE-416

CVE-2026-27950: fallo de gravedad media en FreeRDP

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear FreeRDP+ Monitorear freerdp3

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.5epss 0.5%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
FreeRDP · FreeRDP
CVEs relacionadas — FreeRDP

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-45700HIGHHeap-buffer-overflow write in planar bitmap decoderEPSS 6.1%CVE-2026-44420HIGHFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSEPSS 4.6%CVE-2024-32459CRITICALFreeRDP Out-Of-Bounds Read in ncrush_decompressEPSS 3.7%CVE-2022-24882CRITICALServer side NTLM does not properly check parameters in FreeRDPEPSS 2.8%CVE-2022-24883HIGHFreeRDP Server authentication might allow invalid credentials to passEPSS 2.3%CVE-2020-11019MEDIUMOut of bound read in update_recv in FreeRDPEPSS 2.3%