CVE-2026-56297

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.22.0

Description A heap use-after-free occurs in the Dynamic Virtual Channel (drdynvc) handling path due to improper synchronization of channel callback access. A malicious RDP server can trigger a race condition by sending DYNVC DATA and DYNVC CLOSE messages concurrently, causing the dvcman channel close and dvcman call on receive functions to access freed memory in the drdynvc client thread. This can lead to a denial of service via a client crash or potentially enable remote code execution within the context of the client process.

Recommendations Update to version 3.22.0.