CVE catalog

CVE-2026-27950

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution

[CVE catalog]

Severity: Medium · CVSS 5.5
Published: Feb 24, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.50% · Oct 25, 2026

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	freerdp2	bookworm	`2.11.7+dfsg1-6~deb12u1`	not affected
Cpe	freerdp2	Not reported	Not reported	vulnerable
Cpe	freerdp3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	freerdp3-dev	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	freerdp3-shadow-x11	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	freerdp3-wayland	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	freerdp3-x11	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libfreerdp-client3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libfreerdp-server3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libfreerdp-shadow-subsystem3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libfreerdp-shadow3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libfreerdp3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libwinpr-tools3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libwinpr3-3	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	libwinpr3-dev	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Cpe	winpr3-utils	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	fixed
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3`	vulnerable
Ubuntu	freerdp	16.04	`1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4`	vulnerable
Ubuntu	freerdp2	pro	`2.10.0+dfsg1-1.1ubuntu1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1build1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.2+dfsg1-1build3`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1build1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1build2`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm1`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm2`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm3`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm4`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm5`	vulnerable
Ubuntu	freerdp2	pro	`2.11.5+dfsg1-1ubuntu0.1~esm6`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1`	vulnerable
Ubuntu	freerdp	18.04	`1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2build1`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.3.0+dfsg1-2ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.4.1+dfsg1-1ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.5.0+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.0+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.1`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.2`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.3`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.4`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.5`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.6`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.7`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.8`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.9`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.10`	vulnerable
Ubuntu	freerdp2	22.04	`2.6.1+dfsg1-3ubuntu2.11`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu2`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu3`	vulnerable
Ubuntu	freerdp3	24.04	`3.4.0+dfsg1-0ubuntu4`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.0+dfsg1-0ubuntu1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.1`	vulnerable
Ubuntu	freerdp3	24.04	`3.5.1+dfsg1-0ubuntu1.2`	fixed
Ubuntu	freerdp3	25.10	`3.14.0+dfsg-1ubuntu1`	vulnerable
Ubuntu	freerdp3	25.10	`3.15.0+dfsg-2.1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-1ubuntu1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.1`	vulnerable
Ubuntu	freerdp3	25.10	`3.16.0+dfsg-2ubuntu0.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	freerdp2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Cpe	freerdp3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	freerdp3-dev	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	freerdp3-shadow-x11	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	freerdp3-wayland	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	freerdp3-x11	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libfreerdp-client3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libfreerdp-server3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libfreerdp-shadow-subsystem3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libfreerdp-shadow3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libfreerdp3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libwinpr-tools3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libwinpr3-3	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	libwinpr3-dev	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Cpe	winpr3-utils	cpe	Not reported	`3.5.1+dfsg1-0ubuntu1.4`	Not reported	Not reported	Not reported
Ubuntu	freerdp3	deb	24.04	`3.5.1+dfsg1-0ubuntu1.2`	Not reported	UBUNTU-CVE-2026-27950	Not reported
Ubuntu	freerdp3	deb	25.10	`3.16.0+dfsg-2ubuntu0.3`	Not reported	UBUNTU-CVE-2026-27950	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[freerdp3-dev]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-proxy]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-proxy-modules]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-sdl]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-shadow-x11]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-wayland]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp3-x11]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-proxy]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-proxy-modules]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-sdl]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-shadow-x11]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-wayland]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[freerdp-x11]Affected
Source package: [freerdp3]
Details (2)
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp-client3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp-server3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp-server-proxy3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp-shadow3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libfreerdp-shadow-subsystem3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
[libwinpr3-3]Affected
Source package: [freerdp3]
Details (4)
- 3.15.0+dfsg-2.1+deb13u3 · amd64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.15.0+dfsg-2.1+deb13u3 · arm64 · trixie
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13
- 3.30.0+dfsg-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · freerdp3 · debian · 13

Next results

Observed: Oct 24, 2026, 12:38:22 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]