Cloudanix VulnDB

CVE-2026-24491

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Feb 9, 2026

CISA due date

—

The record

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 freerdp 0 2.11.7-1.2.mga9
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.4.0-150400.3.38.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.11.2-150600.4.9.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.11.2-150600.4.15.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 3.10.3-150700.3.6.1
SUSE:Linux Enterprise Server 12 SP5-LTSS freerdp 0 2.1.2-12.57.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 freerdp 0 2.1.2-12.57.1
SUSE:Linux Enterprise Workstation Extension 15 SP7 freerdp 0 3.10.3-150700.3.6.1
openSUSE:Leap 15.6 freerdp 0 2.11.2-150600.4.9.1
openSUSE:Leap 15.6 freerdp 0 2.11.2-150600.4.15.1
openSUSE:Leap 16.0 freerdp 0 3.22.0-160000.1.1
openSUSE:Leap 16.0 freerdp2 0 2.11.7-bp160.2.1
openSUSE:Tumbleweed freerdp 0 3.22.0-1.1
openSUSE:Tumbleweed freerdp2 0 2.11.7-5.1

Related vulnerabilities