CVE-2026-24684 FreeRDP has a Heap-use-after-free in play_thread

High 8.7 Published 9 Feb 2026 Updated 10 Feb 2026

A use-after-free in FreeRDP's RDPSND playback thread allows attackers to execute code or cause denial of service via crafted RDP packets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24684?

CVE-2026-24684 is a high-severity use after free vulnerability in Freerdp Freerdp, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.

Weakness: CWE-416

Which versions are affected by CVE-2026-24684?

It affects 1 product.

Linux distribution packages (4)

`freerdp` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`2.11.2-150600.4.21.1`
`freerdp2` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`2.11.7-150700.3.17.1`
`freerdp2` SUSE:Linux Enterprise Workstation Extension 15 SP7	All versions	`2.11.7-150700.3.17.1`
`freerdp` openSUSE:Leap 15.6	All versions	`2.11.2-150600.4.21.1`

Products include Freerdp Freerdp.

How do I fix CVE-2026-24684?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-24684 being exploited?

There is no known exploitation of CVE-2026-24684 in the wild and no public exploit code.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-24684, GHSA-vcgv-xgjp-h83q, SUSE-SU-2026:1217-1, SUSE-SU-2026:1313-1, UBUNTU-CVE-2026-24684.