CVE-2026-23884 is a use after free (CVSS 9.8) in FreeRDP. After an offscreen bitmap is deleted, a drawing pointer still refers to freed memory, and later update packets from a malicious server can trigger the bug. FreeRDP 3.21.0 fixes it. Upgrade clients and avoid untrusted servers.
What's affected
FreeRDP up to and including 3.20.2. The patched release is 3.21.0. The vulnerable code is in the client, so the exposure is for users and tools that connect to RDP servers.
How to check if you're exposed
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -q freerdp
Look at applications that bundle FreeRDP as well, such as remote desktop front ends and gateways.
What to do now
- Upgrade to FreeRDP 3.21.0 or later.
- Rebuild any image or application that includes its own copy.
- Connect only to trusted RDP servers until you patch.
Why it matters
The weakness is CWE-416, use after free. Here a pointer to the currently drawn bitmap is not cleared when that bitmap is deleted. The next update that touches it uses memory that may have been reused.
It was fixed together with CVE-2026-23883, so a single upgrade covers both. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-01-19. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is this the same bug as CVE-2026-23883?
No. Both are use after free flaws in FreeRDP fixed in 3.21.0, but they sit in different code: cursor handling for one, offscreen bitmap handling for the other.
Sources
Last reviewed: 19 October 2026.
