Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.

INFO

Published Date :

2026-02-09T18:19:45.222Z

Last Modified :

2026-02-10T16:02:05.475Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-24680 vulnerability.

Vendors Products
Freerdp
  • Freerdp
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24680.

URL Resource
https://github.com/FreeRDP/FreeRDP/commit/c42ecbd183b001e76bfc3614cddfad0034acc758 cve-icon cve-icon cve-icon
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j893-9wg8-33rc cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-24680 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-24680 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact