Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-109253

Freerdp: out-of-bounds read can lead to denial of service

Risk score
41/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Re…
Affected
Freerdp before 3.32.0
Fix
Upgrade Freerdp to 3.32.0 or later.
Exploitation
Public proof of concept

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-109253Out-of-bounds read can lead todenial of serviceCVSS 5.3 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)399 other warnings in 30 days →Same productEarlier Freerdp warnings53 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

  • CVE-2026-109253: Out-of-bounds read can lead to denial of service (CVSS 5.3 · EPSS 0%)
  • CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
  • CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Public exploit or proof of concept referenced

References

Original description

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.

Last activity 12 Oct 2026. Patch Forecast updates every hour.