FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a clientโside use after free, causing a crash (DoS) and potential heap corruption with codeโexecution risk depending on allocator behavior a
VulnCheck: FreeRDP is
Exploit
CVE-2026-23883
VulnCheck
Update to v3.21.0