CVE-2026-24684
Publication date 9 February 2026
Last updated 16 October 2026
Ubuntu priority
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| freerdp2 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble |
Fixed in 2.11.5+dfsg1-1ubuntu0.1~esm5
|
|
| 22.04 LTS jammy |
Fixed in 2.6.1+dfsg1-3ubuntu2.10
|
|
| 20.04 LTS focal |
Fixed in 2.6.1+dfsg1-0ubuntu0.20.04.2+esm3
|
|
| 18.04 LTS bionic | Ignored changes too intrusive | |
| freerdp3 | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Not affected
|
|
| 24.04 LTS noble |
Fixed in 3.5.1+dfsg1-0ubuntu1.2
|
|
| 22.04 LTS jammy | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version:
Base score
8.7 · High
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8042-1
- FreeRDP vulnerabilities
- 16 February 2026