CVE-2026-24678

HIGH

FreeRDP < 3.22.0 - Use-After-Free in ecam_channel_write

Title source: llm

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fixed in 3.22.0.

References (8)

Core 8

Core References

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19033

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:3068

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:4121

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-24678

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2438197

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24678.json

Patch, Vendor Advisory x_refsource_confirm

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6gvg-29wx-6v7h

Patch x_refsource_misc

https://github.com/FreeRDP/FreeRDP/commit/f3ab1a16139036179d9852745fdade18fec11600

View Patch ZIP pw:eip

Scores

CVSS v3 7.5

EPSS 0.0063

EPSS Percentile 46.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-416 CWE-825

Status published

Products (2)

freerdp/freerdp < 3.22.0

FreeRDP/FreeRDP < 3.22.0

Published Feb 09, 2026

Tracked Since Feb 18, 2026