Use-After-Free Vulnerability in FreeRDP by FreeRDP

CVE-2026-56297

What is CVE-2026-56297?

FreeRDP, a widely-used Remote Desktop Protocol client, contains a use-after-free vulnerability due to improper synchronization in the handling of channel callbacks. This issue arises in the dvcman_channel_close and dvcman_call_on_receive functions, where a malicious RDP server can exploit the vulnerability by sending DYNVC_DATA and DYNVC_CLOSE messages simultaneously. This race condition may lead to heap-use-after-free situations in the drdynvc client thread, potentially allowing an attacker to execute arbitrary code remotely or cause a denial of service.

References