漏洞信息 Summary Package: FreeRDP (C) Affected versions: <= 3.20.0 Patched versions: 3.20.1 CVE ID: CVE-2026-22851 Description A race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to (SDL_Surface) is accessed after it has been freed during RDPGFX ResetGraphics handling. Details 1. Pointer escape SDL/client/SDL/SDL3/sdl_freerdp.cpp Line 367 2. Free (ResetGraphics handling) SDL/client/SDL/SDL3/sdl_freerdp.cpp Lines 470-472 This path is executed in the RDPGFX dynamic virtual channel thread. 3. Use-after-free SDL/client/SDL/SDL3/sdl_freerdp.cpp Lines 386-387 PoC AddressSanitizer Impact The vulnerability is caused by improper cross-thread lifetime management of the primary and represents a memory safety violation. Affects FreeRDP SDL client only Severities and Weaknesses Severity: Moderate Weaknesses: - CWE-362 - CWE-416