CVE-2026-44422Active Exploitation(freerdp / freerdp)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for freerdp freerdp systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.

freerdp CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-415CWE-416CWE-825

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

freerdp

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-05-30); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

freerdp

Products

freerdp

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Active Exploitation

133.3%

Disclosure

133.3%

PoC

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-30	2	Active Exploitation1Disclosure1
2026-07-22	1	PoC1

Full discourse3 posts

Daily CyberSecurity@Daily_CyberSec83d
PoC
FreeRDP heap buffer overflow allows remote code execution. PoC exploits are publicly disclosed. Related to CVE-2026-44421, CVE-2026-44422, CVE-2026-40033. #FreeRDP #HeapBufferOverflow #CVE202644421 #CyberSecurity http://securityonline.info/cve-2026-44421-freerdp-heap-buffer-overflow-poc/
Post summary
The post announces heap‑buffer‑overflow CVEs in FreeRDP, notes that PoC exploits are publicly disclosed, and provides a link for additional details.
090282897
12.9K followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
Some increased actor activities are shown targeting FreeRDP (CVE-2026-44422) https://vuldb.com/vuln/367379/cti
Post summary
The statement indicates actors are actively targeting FreeRDP CVE‑2026‑44422, but no PoC, exploit details, or patch information is provided.
0000058
2.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-44422 Heap Use-After-Free in FreeRDP RDPEAR NDR Parser Prior to... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44422 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces a new CVE (Heap UAF in FreeRDP) and links to a vulnerability database, but provides no PoC, exploit, or patch details.
0000055
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	freerdp	freerdp	-	-	-

Explore more

Back to dashboard freerdp CVEs freerdp vulnerabilities