CVE Intelligence
Analysis AI-assisted

CVE-2026-22857: FreeRDP heap use-after-free in irp_thread_func

FreeRDP contains a heap use-after-free in irp_thread_func, where an IRP is accessed again after it has been freed on an error path. The NVD rates the issue critical with a score of 9.8, and versions before 3.20.1 are listed as affected. The record shows no CISA KEV listing and no confirmed active exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. According to the record, a heap use-after-free in the function irp_thread_func occurs because an IRP is freed by a completion call and then accessed again on an error path. The record states that the issue is fixed in 3.20.1.

Impact

  • The weakness class is CWE-416 (Use After Free), which in general can lead to memory corruption in the affected process.
  • The NVD assigns a score of 9.8 (critical), while GitHub assigns a score of 6.8 to the same issue.
  • The record's SSVC data lists technical impact as total.

Affected products and versions

  • Product: FreeRDP (listed in the record as Freerdp Freerdp).
  • Versions before 3.20.1 are listed as affected.
  • The fixed version given in the record is 3.20.1.

Exploitation status

  • The vulnerability is not listed in the CISA KEV catalog in this record. No confirmed active exploitation appears in the sources consulted.
  • The record shows an SSVC exploitation value of 'poc', which indicates proof-of-concept material is considered to exist; this is not confirmed exploitation in the wild.
  • The GitHub advisory reference carries an exploit-related tag in the record; its content was not reviewed beyond that tag.
  • EPSS gives a probability of 0.00531 with a percentile of 0.44087.

Remediation and mitigation

  • Upgrade FreeRDP to 3.20.1 in all deployments, including copies bundled inside third-party software.
  • Check vendor and distribution packages, because the record does not list fixed builds for downstream products.
  • Until the upgrade is done, limit exposure of RDP-capable services to trusted networks and restrict who can reach them.

Detection guidance

  • Inventory systems that run FreeRDP and record their versions.
  • Watch for unexpected crashes or restarts of FreeRDP-based services, which may indicate memory faults.
  • Review remote desktop connection logs for unusual session activity.

Limitations of the available information

  • The record does not list fixed versions other than 3.20.1, nor any backports.
  • Whether the NVD score or the GitHub score better reflects a given environment is unknown.
  • The record does not state whether public exploit code exists in practice; this analysis does not provide exploit details.
  • Technical details of the patch are not present in the record.

Frequently asked questions

What is the vulnerability in CVE-2026-22857?

It is a heap use-after-free in the irp_thread_func function of FreeRDP, where an IRP is accessed again after being freed on an error path.

Which FreeRDP versions are affected?

The record lists versions before 3.20.1 as affected, and the fixed version given is 3.20.1.

Is this vulnerability known to be actively exploited?

No. The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.