Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T13:49:01 FreeRDP: FreeRDP: Remote code execution or denial of service via use-after-free race condition 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CWE-364

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a use-after-free vulnerability due to improper synchronization of channel callback access. By sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, a race condition can be triggered in the drdynvc client thread, leading to heap-use-after-free. This could potentially enable remote code execution or cause a denial of service.

This Moderate impact flaw in FreeRDP allows a malicious RDP server to trigger a use-after-free condition on the client by exploiting a race condition during dynamic virtual channel closure. This could lead to remote code execution or denial of service on the client system when connecting to a compromised or untrusted RDP server. Configure host-based firewalls (e.g., firewalld) or network egress filtering so that the workstation can only initiate outbound RDP connections (typically TCP 3389) to known, trusted internal RDP gateways or corporate servers. Blocking outbound RDP to the wider internet neutralizes the threat of users accidentally connecting to malicious external endpoints. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Affected freerdp Red Hat Enterprise Linux 8 Affected freerdp Red Hat Enterprise Linux 9 Affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-56297 https://nvd.nist.gov/vuln/detail/CVE-2026-56297 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h https://www.vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback