Use-after-free in FreeRDP - #VU164428
Published: November 10, 2026
Vulnerability identifier: #VU164428
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the FreeRDP client.
The vulnerability exists due to use-after-free in FreeRDP's URBDRC teardown when active libusb transfers are freed without waiting for asynchronous cancellation to complete. A remote attacker can lure a victim into connecting to a controlled server with USB redirection enabled, submit a valid isochronous USB request, and trigger device or session teardown while the transfer remains active to crash the client through subsequent libusb access or late callback delivery.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.32.2