CVE-2026-44422: FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion

Synopsis

A heap use-after-free and double-free in FreeRDP's RDPEAR NDR parser lets a malicious RDP server corrupt memory in the connecting client. Reaching the bug requires the client to connect to an attacker-controlled server (network vector with required user interaction), no authentication needed, and successful exploitation can lead to code execution or crash of the client process with full read, modify, and disrupt impact. A patched-image rebuild at FreeRDP 3.26.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The client must connect over the network to a server controlled by the attacker for the malicious RDPEAR messages to be parsed.

• AuthenticationNot required

  The malicious server does not need any credentials on the victim client to send the crafted NDR pointer fields.

• Victim interactionRequired

  A user must initiate or accept an RDP connection to the attacker's server, so the vector relies on luring the client to connect.

• Attack complexityDetail

  Attack complexity is High: reliable exploitation depends on heap layout and timing around the double-free and type confusion.

Blast Radius

• Corrupts heap memory in the FreeRDP client process, enabling type confusion that an attacker can steer toward arbitrary code execution under the user running the RDP client.
• Reads memory contents reachable from the freed objects, including authentication material handled in the RDPEAR redirection path.
• Modifies in-process state by reusing the aliased pointer, letting the malicious server influence subsequent client behavior.
• Crashes the FreeRDP client through the double-free, disrupting the user's remote session.