Freerdp3: Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in… (CVE-2026-24678)
FreeRDP3 versions prior to 3.22.0 contain a use-after-free vulnerability in the ecam_channel_write function caused by a capture thread sending sample responses using a freed channel callback after a device channel closes. This flaw can lead to denial of service or potentially arbitrary code execution. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity) and affects specific Ubuntu package versions. An official patch is available in FreeRDP 3.22.0 and later.
AI Analysis
Technical Summary
FreeRDP3, a Remote Desktop Protocol client, has a use-after-free vulnerability (CVE-2026-24678) in versions prior to 3.22.0. The issue arises when a capture thread sends sample responses using a channel callback that has already been freed following a device channel close, leading to unsafe memory access in the ecam_channel_write function. This vulnerability can cause denial of service or possibly allow arbitrary code execution. The vulnerability is fixed in FreeRDP version 3.22.0. The Ubuntu security advisory USN-8042-1 confirms the fix and provides updated package versions for Ubuntu releases including 25.10 and 24.04 LTS.
Potential Impact
The vulnerability can be exploited remotely without privileges or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). It can cause denial of service (application crash) or potentially arbitrary code execution, impacting availability and possibly system integrity. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available in FreeRDP version 3.22.0 and later. Ubuntu users should update to the patched package versions as specified in the Ubuntu security notice USN-8042-1. Standard system updates will apply the necessary fixes. No additional mitigation actions are required beyond applying the official patch.
Freerdp3: Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in… (CVE-2026-24678)
Description
FreeRDP3 versions prior to 3.22.0 contain a use-after-free vulnerability in the ecam_channel_write function caused by a capture thread sending sample responses using a freed channel callback after a device channel closes. This flaw can lead to denial of service or potentially arbitrary code execution. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity) and affects specific Ubuntu package versions. An official patch is available in FreeRDP 3.22.0 and later.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/freerdp3?arch=source&distro=questingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeRDP3, a Remote Desktop Protocol client, has a use-after-free vulnerability (CVE-2026-24678) in versions prior to 3.22.0. The issue arises when a capture thread sends sample responses using a channel callback that has already been freed following a device channel close, leading to unsafe memory access in the ecam_channel_write function. This vulnerability can cause denial of service or possibly allow arbitrary code execution. The vulnerability is fixed in FreeRDP version 3.22.0. The Ubuntu security advisory USN-8042-1 confirms the fix and provides updated package versions for Ubuntu releases including 25.10 and 24.04 LTS.
Potential Impact
The vulnerability can be exploited remotely without privileges or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). It can cause denial of service (application crash) or potentially arbitrary code execution, impacting availability and possibly system integrity. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available in FreeRDP version 3.22.0 and later. Ubuntu users should update to the patched package versions as specified in the Ubuntu security notice USN-8042-1. Standard system updates will apply the necessary fixes. No additional mitigation actions are required beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-24678
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:25.10"]
- Cvss Version
- 3.1
Patch Information
Threat ID: 6aa2af7eacd9273b4925ad8a
Added to database: 09/10/2026, 13:24:14 UTC
Last enriched: 09/10/2026, 13:34:51 UTC
Last updated: 09/10/2026, 19:36:53 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.