Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-24491

FreeRDP has a heap-use-after-free in video_timer

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

  • < 3.22.0affected

References