Bug 2430885 (CVE-2026-23883)

Summary:	CVE-2026-23883 freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit a use-after-free vulnerability by enticing a client to connect to it. This can lead to a client-side crash, resulting in a Denial of Service (DoS), and potentially allow for arbitrary code execution due to heap corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2430920, 2430922, 2430924, 2430921, 2430923
Bug Blocks:

Description OSIDB Bzimport 2026-01-19 18:02:10 UTC

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Comment 1 errata-xmlrpc 2026-02-05 10:19:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:2048 https://access.redhat.com/errata/RHSA-2026:2048

Comment 2 errata-xmlrpc 2026-02-05 11:43:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:2081 https://access.redhat.com/errata/RHSA-2026:2081

Comment 3 errata-xmlrpc 2026-02-09 01:33:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:2222 https://access.redhat.com/errata/RHSA-2026:2222

Comment 4 errata-xmlrpc 2026-02-16 13:05:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:2736 https://access.redhat.com/errata/RHSA-2026:2736

Comment 5 errata-xmlrpc 2026-02-17 03:25:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:2770 https://access.redhat.com/errata/RHSA-2026:2770

Comment 6 errata-xmlrpc 2026-02-17 15:55:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:2824 https://access.redhat.com/errata/RHSA-2026:2824

Comment 7 errata-xmlrpc 2026-02-18 14:30:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:2952 https://access.redhat.com/errata/RHSA-2026:2952

Comment 8 errata-xmlrpc 2026-02-23 01:50:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:3037 https://access.redhat.com/errata/RHSA-2026:3037