VYPR
advisoryPublished Oct 12, 2026· Updated Oct 13, 2026· 1 source

FreeRDP: 18 Vulnerabilities Disclosed, Including High-Severity Memory Corruption Flaws

Key findings • 18 vulnerabilities disclosed for FreeRDP on October 12, 2026, ranging from Low to High severity. • Multiple memory corruption flaws including double-free, heap overflows, and u…

Key findings

  • 18 vulnerabilities disclosed for FreeRDP on October 12, 2026, ranging from Low to High severity.
  • Multiple memory corruption flaws including double-free, heap overflows, and use-after-free vulnerabilities.
  • Insecure handling of file paths and permissions allows for path traversal and private key exposure.
  • High-severity CVE-2026-109242 involves rendering uninitialized heap memory, posing risks of information disclosure or crashes.
  • All vulnerabilities are fixed in FreeRDP version 3.32.0, with specific exceptions noted.

On October 12, 2026, a batch of 18 vulnerabilities was disclosed for the FreeRDP remote desktop client. These vulnerabilities, all disclosed on the same day, span a range of severity levels from Low to High, with the most critical being CVE-2026-109242, a High-severity flaw. The disclosures highlight potential risks for users connecting to or from FreeRDP clients, particularly concerning memory corruption, information disclosure, and denial-of-service conditions.

Several vulnerabilities stem from improper handling of memory and data structures during RDP session operations. CVE-2026-109257, a double-free vulnerability in nsc_context_initialize_encode(), can lead to server crashes if an attacker crafts an RDP client with a large desktop geometry. Similarly, CVE-2026-109256 describes a heap buffer overflow in the WinPR PNG write callback, triggered by a malicious RDP clipboard peer supplying a large CF_DIB image. CVE-2026-109255, an integer truncation in license_check_stream_length, can result in a heap buffer overflow on 32-bit clients when a malicious RDP server sends a crafted SERVER_LICENSE_REQUEST. Another memory corruption issue, CVE-2026-109254, is a use-after-free vulnerability in the static rdpsnd channel disconnect path, where freeing audio formats and devices without proper thread synchronization can lead to client crashes.

Further memory-related issues include CVE-2026-109253, an out-of-bounds read in RDPEAR NDR scalar readers, and CVE-2026-109252, a NULL pointer dereference in the RDPEAR NDR reader, both exploitable by malicious RDP servers to crash clients. CVE-2026-109251 involves an unchecked server-supplied geometry origin that can lead to an out-of-bounds write due to 32-bit arithmetic wrapping. CVE-2026-109250 details a heap buffer overflow in collect_keys() during PKCS#11 key enumeration, which can be triggered by local attackers controlling smartcard tokens. CVE-2026-109248 presents a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), exploitable by malicious RDP servers. Finally, CVE-2026-109246, a divide-by-zero vulnerability in the freerdp-shadow-cli server, can be triggered by an authenticated client acknowledging frames with an underflowed count.

Several vulnerabilities relate to insecure handling of file paths and permissions. CVE-2026-109247, a path traversal vulnerability in convert_filedescriptors_to_file_list(), allows attackers to access arbitrary files by supplying crafted filenames in clipboard data. CVE-2026-109244 and CVE-2026-109243 highlight insecure permissions in winpr-makecert and crypto_write_pem, respectively, allowing local users to read private keys due to world-readable file modes or predictable temporary directory usage.

Other notable vulnerabilities include CVE-2026-109245, an improper certificate validation flaw in freerdp_http_request(), which allows on-path attackers to impersonate servers during Azure AD authentication. CVE-2026-109242, the highest severity vulnerability, involves rendering uninitialized heap memory from progressive tiles due to un-zeroed allocated buffers, potentially leading to information disclosure or client crashes. CVE-2026-109241, a NULL pointer dereference in the client video redirection channel, can be triggered by malicious servers sending out-of-order messages. CVE-2026-109240 is a reachable assertion in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values.

All disclosed vulnerabilities affect FreeRDP versions prior to 3.32.0, with specific exceptions noted for CVE-2026-109256 (prior to 3.32.2), CVE-2026-109242 (prior to 3.0.0 and 3.6.0 before 3.32.0), and CVE-2026-109240 (3.11.0 before 3.32.1). The fix for the majority of these issues is available in FreeRDP version 3.32.0. Users are strongly advised to update to the patched versions to mitigate these security risks.

This extensive batch of vulnerabilities underscores the importance of keeping FreeRDP clients updated. The variety of issues, from memory corruption to insecure permissions and certificate validation, indicates a broad attack surface. Users should prioritize updating to version 3.32.0 or later to address these critical security flaws.

CVE-2026-109257 CVE-2026-109256 CVE-2026-109255 CVE-2026-109254 CVE-2026-109253 CVE-2026-109252 CVE-2026-109251 CVE-2026-109250 CVE-2026-109249 CVE-2026-109248 CVE-2026-109247 CVE-2026-109246 CVE-2026-109245 CVE-2026-109244 CVE-2026-109243 CVE-2026-109242 CVE-2026-109241 CVE-2026-109240

Synthesized by Vypr AI