CVE-2026-24676: Freerdp Audin Format Uaf

A use-after-free condition can occur if the `formats` array is freed but an active alias referencing one of the formats (e.g. `audin->format`) is not explicitly cleared. Concurrent threads accessing this dangling pointer may lead to a crash or arbitrary code execution. Ensure the active format is set to NULL before calling `audio_formats_free`.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-24676-freerdp-audin-format-uaf --engine opengrep

Description

A use-after-free condition can occur if the `formats` array is freed but an active alias referencing one of the formats (e.g. `audin->format`) is not explicitly cleared. Concurrent threads accessing this dangling pointer may lead to a crash or arbitrary code execution. Ensure the active format is set to NULL before calling `audio_formats_free`.