CVE-2026-44422

A flaw was found in FreeRDP. A malicious server can exploit a heap use-after-free or double-free vulnerability in the FreeRDP client's RDPEAR authentication-redirection path. This occurs because the RDPEAR NDR parser incorrectly handles pointer reference IDs, leading to the same heap object being assigned to multiple pointer fields. This flaw could allow a remote attacker to execute arbitrary code or cause a denial of service on the client system.

A critical FreeRDP flaw in the RDPEAR path incorrectly handles pointer reference IDs. If a user connects to a malicious server, it can trigger a heap use-after-free or double-free, causing arbitrary code execution or a denial of service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this risk, avoid connecting to untrusted RDP servers and use firewall rules to restrict FreeRDP clients to trusted servers. If FreeRDP is not needed, remove the package to eliminate the attack vector, though this may affect dependent applications.

To remove the package: sudo dnf remove freerdp