CVE-2026-109951

5.3Medium

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-125

Impact

A malicious backend RDP server can crash the freerdp-proxy process or leak heap memory into proxy logs. The attacker needs control of the backend RDP server that the proxy connects to.

Root cause

The DRDYNVC channel handler performs an unbounded snprintf read when processing a CREATE_REQUEST_PDU channel name that lacks a NUL terminator.

Affected systems

FreeRDP 3.17.1 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading immediately is not possible, restrict freerdp-proxy connections only to trusted backend RDP servers.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-proxy

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109951