CVE-2026-44422
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2026-44422 NameCVE-2026-44422 DescriptionFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object…
CVE-2026-44422
| Name | CVE-2026-44422 |
| Description | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| freerdp2 (PTS) | bullseye | 2.3.0+dfsg1-2+deb11u1 | vulnerable |
| bullseye (security) | 2.3.0+dfsg1-2+deb11u3 | vulnerable | |
| bookworm | 2.11.7+dfsg1-6~deb12u1 | vulnerable | |
| freerdp3 (PTS) | trixie | 3.15.0+dfsg-2.1+deb13u3 | vulnerable |
| forky, sid | 3.26.0+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| freerdp2 | source | (unstable) | (unfixed) | |||
| freerdp3 | source | (unstable) | 3.26.0+dfsg-1 |
Notes
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j9q5-7g8m-jc9v
Apply commands
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j9q5-7g8m-jc9vOS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Mixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Affected | — |
| sid | Fixed | 3.26.0+dfsg-1 |
| forky | Fixed | 3.26.0+dfsg-1 |
| bullseye | Affected | — |
| bookworm | Affected | — |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| freerdp | freerdp | {"endExcluding":"3.26.0"} | 3.26.0 |
References
CWEs
CWE-415 CWE-416
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.