CVE-2026-23883 is a use after free (CVSS 9.8) in the FreeRDP X11 client. A malicious RDP server can trigger a double free in cursor handling, which can crash the client and may corrupt memory. FreeRDP 3.21.0 fixes it. Upgrade, and do not connect to RDP servers you do not trust.
What's affected
FreeRDP before 3.21.0. The attack direction matters: the vulnerable code runs in the client, so the risk is to people and tools that connect out to a hostile or compromised RDP server. The related issue CVE-2026-23884 was fixed in the same release.
How to check if you're exposed
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -q freerdp
Also check tools that embed the library, such as remote desktop clients, Remmina, and jump host or gateway tooling. Container images may carry their own copy.
What to do now
- Upgrade to FreeRDP 3.21.0 or a distribution package that includes the fix.
- Update software that bundles FreeRDP, and rebuild images that include it.
- Connect only to RDP servers you control or trust until you have patched.
- Treat a crash of an RDP client when connecting to an unfamiliar host as worth investigating.
Why it matters
The weakness is CWE-416, use after free. In this case the failure path in one function frees cursor pixel data, and a cleanup function then frees it again. Error handling paths are a common source of such bugs because they get less testing than the normal path.
The vendor describes the outcome as a crash and potential heap corruption with code execution depending on allocator behavior. That wording is cautious, and it is the right level to keep. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-01-19. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Remote desktop clients connect your machine to a server you may not control, so patch them like browsers. Keep one approved client build on managed laptops and jump hosts, and update it centrally. If your build pipelines or support tools embed FreeRDP, track that version in your software bill of materials. Use network level access controls so staff can connect only to known RDP hosts, which also limits the chance of a rogue server at a lookalike address.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect an RDP server I host?
The advisory describes a flaw in the client, triggered by a malicious server. A server you host is not the component named here, but any client tools you run that use FreeRDP should be updated.
Sources
Last reviewed: 19 October 2026.
