Cloudanix VulnDB

CVE-2026-24684

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Feb 9, 2026

CISA due date

—

The record

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

Affected packages

Ecosystem Package Introduced Fixed
Mageia:9 freerdp 0 2.11.7-1.2.mga9
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.4.0-150400.3.38.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.11.2-150600.4.9.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 3.10.3-150700.3.6.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 freerdp 0 2.11.2-150600.4.21.1
SUSE:Linux Enterprise Server 12 SP5-LTSS freerdp 0 2.1.2-12.57.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 freerdp 0 2.1.2-12.57.1
SUSE:Linux Enterprise Workstation Extension 15 SP7 freerdp 0 3.10.3-150700.3.6.1
openSUSE:Leap 15.6 freerdp 0 2.11.2-150600.4.9.1
openSUSE:Leap 15.6 freerdp 0 2.11.2-150600.4.21.1
openSUSE:Leap 16.0 freerdp 0 3.22.0-160000.1.1
openSUSE:Leap 16.0 freerdp2 0 2.11.7-bp160.2.1
openSUSE:Tumbleweed freerdp 0 3.22.0-1.1
openSUSE:Tumbleweed freerdp2 0 2.11.7-5.1

Related vulnerabilities