Is CVE-2026-27950 actively exploited?

No active exploitation of CVE-2026-27950 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27950 be exploited remotely?

Yes. CVE-2026-27950 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27950?

CVE-2026-27950 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.08%.

HOME VULNERABILITIESCVE-2026-27950

HIGH

CVE-2026-27950

CWE-416Published: February 25, 2026· Updated: Feb 27, 2026

7.5

CVSS v3.1

EPSS:0.08%probability of exploitation in 30 daysPercentile:22.9th

Official Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the fix for the heap-use-after-free described in CVE-2026-24680 is incomplete. While the vulnerable execution flow referenced in the advisory exists in the SDL2 implementation, the fix appears to have been applied only to the SDL3 code path. In the SDL2 implementation, the pointer is not nulled after free. This creates a situation where the advisory suggests the vulnerability is fully resolved, while builds or environments still using SDL2 may retain the vulnerable logic. A complete fix is available in version 3.23.0.

NVD Source

Technical Analysis

CVE-2026-27950 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.