CVE-2026-56297

HIGH

FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback

Title source: cna
STIX 2.1

Description

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-3mv2-5q57-2v8h)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h
Third Party Advisory third-party-advisory
VulnCheck Advisory: FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback
https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback

Scores

CVSS v3 7.0
EPSS 0.0028
EPSS Percentile 20.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-362
Status published
Products (3)
FreeRDP/FreeRDP < 3.22.0
freerdp/freerdp < 3.22.0
FreeRDP/FreeRDP 3.22.0
Published Jul 08, 2026
Tracked Since Jul 08, 2026