Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-23883
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-19 Jan, 2026 | 17:15
Updated At-15 Jul, 2026 | 01:17
Rejected At-
▼CVE Numbering Authority (CNA)
Heap-use-after-free in update_pointer_new

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Affected Products
Vendor
FreeRDPFreeRDP
Product
FreeRDP
Versions
Affected
  • < 3.21.0
Problem Types
TypeCWE IDDescription
CWECWE-416CWE-416: Use After Free
Type: CWE
CWE ID: CWE-416
Description: CWE-416: Use After Free
Metrics
VersionBase scoreBase severityVector
4.07.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Version: 4.0
Base score: 7.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcrr-85qx-4p6x
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L312-L319
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L340
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/pointer.c#L164-L174
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcrr-85qx-4p6x
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L312-L319
Resource:
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L340
Resource:
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/pointer.c#L164-L174
Resource:
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit a use-after-free vulnerability by enticing a client to connect to it. This can lead to a client-side crash, resulting in a Denial of Service (DoS), and potentially allow for arbitrary code execution due to heap corruption.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:10.1
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-5.el10_1.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10.0 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux_eus:10.0
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-3.el10_0.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:8
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-2.el8_10 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:9
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_7.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.0
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-3.el9_0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.2
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-6.el9_2.2 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.4 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.4
Default Status
affected
Versions
Unaffected
  • From 2:2.11.2-1.el9_4.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.6 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.6
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_6.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 6
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:6
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:7
Default Status
unaffected
Problem Types
TypeCWE IDDescription
CWECWE-416Use After Free
Type: CWE
CWE ID: CWE-416
Description: Use After Free
Metrics
VersionBase scoreBase severityVector
3.17.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Version: 3.1
Base score: 7.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:2952: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)

RHSA-2026:2222: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

RHSA-2026:2081: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)

RHSA-2026:2770: Red Hat Enterprise Linux AppStream E4S (v.9.0)

RHSA-2026:2824: Red Hat Enterprise Linux AppStream E4S (v.9.2)

RHSA-2026:2736: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)

RHSA-2026:3037: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)

RHSA-2026:2048: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Reported to Red Hat.2026-01-19 18:01:42
Made public.2026-01-19 17:15:55
Event: Reported to Red Hat.
Date: 2026-01-19 18:01:42
Event: Made public.
Date: 2026-01-19 17:15:55
Replaced By

Rejected Reason

References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-23883
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2430885
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23883.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:2952
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2222
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2081
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2770
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2824
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2736
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3037
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2048
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-23883
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2430885
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23883.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2952
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2222
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2081
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2770
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2824
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2736
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3037
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2048
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found