Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-23884
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-19 Jan, 2026 | 17:20
Updated At-15 Jul, 2026 | 01:17
Rejected At-
â–¼CVE Numbering Authority (CNA)
Heap-use-after-free in gdi_set_bounds

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Affected Products
Vendor
FreeRDPFreeRDP
Product
FreeRDP
Versions
Affected
  • < 3.21.0
Problem Types
TypeCWE IDDescription
CWECWE-416CWE-416: Use After Free
Type: CWE
CWE ID: CWE-416
Description: CWE-416: Use After Free
Metrics
VersionBase scoreBase severityVector
4.07.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Version: 4.0
Base score: 7.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L114-L122
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L87-L91
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L114-L122
Resource:
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/offscreen.c#L87-L91
Resource:
x_refsource_MISC
Hyperlink: https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
Resource:
x_refsource_MISC
â–¼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit this vulnerability when a client connects to it. Specifically, offscreen bitmap deletion can lead to a use-after-free (UAF) condition, where the client attempts to use memory that has already been deallocated. This can cause a crash, resulting in a Denial of Service (DoS), and potentially lead to heap corruption with a risk of arbitrary code execution.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:10.1
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-5.el10_1.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10.0 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux_eus:10.0
Default Status
affected
Versions
Unaffected
  • From 2:3.10.3-3.el10_0.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:rhel_els:7
Default Status
affected
Versions
Unaffected
  • From 0:2.1.1-5.el7_9.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:8
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-2.el8_10 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.2 Advanced Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.2
Default Status
affected
Versions
Unaffected
  • From 2:2.0.0-46.rc4.el8_2.6 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.4
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus_long_life:8.4
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_aus:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_tus:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:8.6
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-7.el8_6.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_tus:8.8
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-12.el8_8.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:8.8
Default Status
affected
Versions
Unaffected
  • From 2:2.2.0-12.el8_8.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:enterprise_linux:9
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_7.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.0
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-3.el9_0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_e4s:9.2
Default Status
affected
Versions
Unaffected
  • From 2:2.4.1-6.el9_2.2 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.4 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.4
Default Status
affected
Versions
Unaffected
  • From 2:2.11.2-1.el9_4.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.6 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/a:redhat:rhel_eus:9.6
Default Status
affected
Versions
Unaffected
  • From 2:2.11.7-1.el9_6.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 6
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
freerdp
CPEs
  • cpe:/o:redhat:enterprise_linux:6
Default Status
affected
Problem Types
TypeCWE IDDescription
CWECWE-416Use After Free
Type: CWE
CWE ID: CWE-416
Description: Use After Free
Metrics
VersionBase scoreBase severityVector
3.17.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Version: 3.1
Base score: 7.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:2714: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)

RHSA-2026:2952: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)

RHSA-2026:2222: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

RHSA-2026:2081: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)

RHSA-2026:3039: Red Hat Enterprise Linux AppStream AUS (v. 8.2)

RHSA-2026:3038: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)

RHSA-2026:3036: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)

RHSA-2026:3041: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)

RHSA-2026:2770: Red Hat Enterprise Linux AppStream E4S (v.9.0)

RHSA-2026:2824: Red Hat Enterprise Linux AppStream E4S (v.9.2)

RHSA-2026:2736: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)

RHSA-2026:3037: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)

RHSA-2026:2048: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Reported to Red Hat.2026-01-19 18:01:13
Made public.2026-01-19 17:20:40
Event: Reported to Red Hat.
Date: 2026-01-19 18:01:13
Event: Made public.
Date: 2026-01-19 17:20:40
Replaced By
Rejected Reason
References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-23884
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2430880
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23884.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:2714
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2952
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2222
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2081
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3039
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3038
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3036
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3041
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2770
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2824
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2736
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3037
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2048
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-23884
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2430880
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23884.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2714
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2952
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2222
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2081
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3039
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3038
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3036
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3041
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2770
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2824
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2736
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:3037
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:2048
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found