Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-109254

Freerdp: use-after-free can lead to denial of service

Risk score
43/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.2%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory…
Affected
Freerdp before 3.32.0
Fix
Upgrade Freerdp to 3.32.0 or later.
Exploitation
Public proof of concept

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-109254Use-after-free can lead todenial of serviceCVSS 5.9 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessUse-after-free (CWE-416)399 other warnings in 30 days →Same productEarlier Freerdp warnings53 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

  • CVE-2026-109254: Use-after-free can lead to denial of service (CVSS 5.9 · EPSS 0%)
  • CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
  • CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • Public exploit or proof of concept referenced

References

Original description

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.

Last activity 12 Oct 2026. Patch Forecast updates every hour.