CVE-2026-44422 Details

A heap use-after-free and double-free vulnerability has been identified in FreeRDP versions prior to 3.26.0. The issue arises in the RDPEAR NDR parser, which accepts a single non-null NDR pointer reference ID for multiple logical pointer fields without properly tracking the expected NDR type or ownership of the pointed objects. When the same reference ID is reused across two pointer fields, the parser mistakenly assigns the same heap object to both fields. The generic destructor then independently processes each field, leading to a situation where both pointers are freed, causing memory corruption. This vulnerability can be exploited by a malicious RDP server to trigger memory corruption in the FreeRDP client, particularly in the RDPEAR authentication-redirection path.

Users should update FreeRDP to version 3.26.0 or later, where this vulnerability has been fixed.