CVE-2026-22851CWE-362CWE-416

FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)

Medium · published January 14, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl->primary (SDL_Surface) is accessed after it has been freed during RDPGFX ResetGraphics handling. This vulnerability is fixed in 3.20.1.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00291 · 20.6th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-01-14T17:43Z
EPSS history
Timeline
  • 14 JAN 17:43Z
    FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)
    cvelistv5