PT-2026-56434 · Freerdp · Freerdp

Jeremylaratro · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56297

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0

Description A heap use-after-free occurs in the Dynamic Virtual Channel (drdynvc) handling path due to improper synchronization of channel callback access. A malicious RDP server can trigger a race condition by sending DYNVC DATA and DYNVC CLOSE messages concurrently, causing the dvcman channel close and dvcman call on receive functions to access freed memory in the drdynvc client thread. This can lead to a denial of service via a client crash or potentially enable remote code execution within the context of the client process.

Recommendations Update to version 3.22.0.

Exploit

Fix

DoS

RCE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-56297

Affected Products

Freerdp

References · 4

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56297 · Security Note
• https://twitter.com/UpwindMDR/status/2074877036833706111 · Twitter Post
• https://vulncheck.com/advisories/freerdp-use-after-free-via-race-condition-in-drdynvc-channel-callback · Note