CVE-2026-109257
5.9MediumPublished 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-415
Impact
Remote, unauthenticated attackers can crash the FreeRDP server by connecting with a crafted client and triggering a denial of service. They need network access to the listening RDP port to negotiate NSCodec with a large desktop geometry.
Root cause
A double-free occurs during context teardown because nsc_context_initialize_encode() fails to clean up dangling plane pointers after a partial buffer growth allocation failure.
Affected systems
FreeRDP versions before 3.32.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to FreeRDP 3.32.0 or later. If upgrading immediately is not possible, restrict network access to the FreeRDP service via firewall rules or disable NSCodec if exposed in the server configuration.
$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.