PT-2026-22020 · Freerdp+3 · Freerdp+3

Ehdgks0627 · Published 2026-01-01 · Updated 2026-05-12 · CVE-2026-26986

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists where the rail window free function dereferences a freed xfAppWindow pointer during HashTable Free cleanup. This occurs because xf rail window common calls free(appWindow) on title allocation failure without first removing the entry from the railWindows hash table, resulting in a dangling pointer that is freed again on disconnect.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2026:16014

ALSA-2026:16019

ALSA-2026:16482

BDU:2026-04154

CVE-2026-26986

GHSA-CRQX-G6X5-RX47

OESA-2026-1516

OESA-2026-1517

OESA-2026-1518

OESA-2026-1519

OESA-2026-1520

OESA-2026-1521

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Rocky Linux

Ubuntu

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26986.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51 · Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24683 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:16019 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22859 · Security Note
• https://ubuntu.com/security/CVE-2026-22854 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-16019.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22858 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22853 · Vendor Advisory