CVE-2026-24684

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24684
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24684.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24684
Aliases
  • GHSA-vcgv-xgjp-h83q
Downstream
Related
Published
2026-02-09T18:23:02.882Z
Modified
2026-07-15T22:57:31.696002Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP has a Heap-use-after-free in play_thread
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsndtreatwave. This vulnerability is fixed in 3.22.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24684.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3ef4c71138f76516299cb3637d2d0c59b2a3737
Fixed
622bb7b4402491ca003f47472d0e478132673696
Fixed
afa6851dc80835d3101e40fcef51b6c5c0f43ea5
Database specific 
{
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.22.0"
        }
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24684.json"
vanir_signatures_modified 
"2026-07-15T22:57:31Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/622bb7b4402491ca003f47472d0e478132673696",
        "id": "CVE-2026-24684-04dc054f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "320311572097518780728811796690758624893",
                "63313115906129110613603736074651103162",
                "252995033149960371784854936696007224435",
                "251892371072136559332524716841156107958",
                "19719109656483084241409752858554859877",
                "194003495590992766253364700688203607408",
                "68193414474714796645160746510110314578",
                "96242589276501001945860564685030044658",
                "16369215670143458953019668364696418258",
                "52269026402565284959146308168088438373",
                "45926920002663016220376242714041135741",
                "115646349199840449234854566762657693779",
                "318604811723192121977739358298625990627",
                "197597468398426326336576493574895798418",
                "154085855765673830825964478243039658654",
                "232723898879576843949616419237326401151",
                "155229659246709589556589146951976802594",
                "322361078014306657792487772276356779078"
            ]
        },
        "target": {
            "file": "channels/rdpsnd/client/rdpsnd_main.c"
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/622bb7b4402491ca003f47472d0e478132673696",
        "id": "CVE-2026-24684-8546c224",
        "digest": {
            "length": 438.0,
            "function_hash": "115192286120414010421354006218434689266"
        },
        "target": {
            "function": "rdpsnd_virtual_channel_event_terminated",
            "file": "channels/rdpsnd/client/rdpsnd_main.c"
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/622bb7b4402491ca003f47472d0e478132673696",
        "id": "CVE-2026-24684-ec0ce8b4",
        "digest": {
            "length": 442.0,
            "function_hash": "225155963875378462766460096470587633624"
        },
        "target": {
            "function": "cleanup_internals",
            "file": "channels/rdpsnd/client/rdpsnd_main.c"
        },
        "deprecated": false,
        "signature_type": "Function"
    }
]