CVE-2026-23883

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

• CWE-416
• CWE-416

• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L312-L319Product
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/client/X11/xf_graphics.c#L340Product
• https://github.com/FreeRDP/FreeRDP/blob/3370e30e92a021eb680892dda14d642bc8b8727c/libfreerdp/cache/pointer.c#L164-L174Product
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcrr-85qx-4p6xExploit, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:2048
• https://access.redhat.com/errata/RHSA-2026:2081
• https://access.redhat.com/errata/RHSA-2026:2222
• https://access.redhat.com/errata/RHSA-2026:2736
• https://access.redhat.com/errata/RHSA-2026:2770
• https://access.redhat.com/errata/RHSA-2026:2824
• https://access.redhat.com/errata/RHSA-2026:2952
• https://access.redhat.com/errata/RHSA-2026:3037
• https://access.redhat.com/security/cve/CVE-2026-23883
• https://bugzilla.redhat.com/show_bug.cgi?id=2430885
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23883.json

Published

Jan 19, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23878HotCRP is conference review software. Starting in commit aa2…6.5
• CVE-2026-23879py7zr is a Python-based library and utility to support 7zip …8
• CVE-2026-2388The Reviews and Rating – Google Reviews plugin for WordPress…6.4
• CVE-2026-23880OnboardLite is a comprehensive membership lifecycle platform…7.3
• CVE-2026-23881Kyverno is a policy engine designed for cloud native platfor…6.5
• CVE-2026-23882Blinko is an AI-powered card note-taking project. Prior to v…7.2
• CVE-2026-23884FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-23885Alchemy is an open source content management system engine w…9.9
• CVE-2026-23886Swift W3C TraceContext is a Swift implementation of the W3C …5.3
• CVE-2026-23887Group-Office is an enterprise customer relationship manageme…5.4
• CVE-2026-23888pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23889pnpm is a package manager. Prior to version 10.28.1, a path …6.5