Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109254— FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

Quick assessment

Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeRDP 2.1.0 到 3.32.0 版本之前存在一个使用-after-free（释放后使用）漏洞，该漏洞位于静态 rdpsnd 通道的断开连接处理路径中。在此路径中，音频格式和设备会被释放，但并未等待 play_thread 线程完成其操作。恶意 RDP 服务器可在异步 Wave2 播放处理排队中的 PDU 数据包时主动断开连接，从而导致客户端读取已释放的堆内存，引发程序崩溃。

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
FreeRDP FreeRDP 2.1.0< 3.32.0 affected
3.32.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109254

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FreeRDP FreeRDP 2.1.0 ~ 3.32.0 -

II. Public POCs for CVE-2026-109254

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109254

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109254 (1)

News Coverage for CVE-2026-109254 (1)

Same Patch Batch · FreeRDP · 2026-10-12 · 18 CVEs total

CVE-2026-109242 7.1 HIGH FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive
CVE-2026-109255 6.8 MEDIUM FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
CVE-2026-109245 6.8 MEDIUM FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request
CVE-2026-109244 6.6 MEDIUM FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert
CVE-2026-109250 6.6 MEDIUM FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()
CVE-2026-109248 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName
CVE-2026-109246 6.5 MEDIUM FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU
CVE-2026-109257 5.9 MEDIUM FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
CVE-2026-109249 5.5 MEDIUM FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing
CVE-2026-109251 5.3 MEDIUM FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry
CVE-2026-109252 5.3 MEDIUM FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAM
CVE-2026-109253 5.3 MEDIUM FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read
CVE-2026-109256 5.3 MEDIUM FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion
CVE-2026-109243 4.4 MEDIUM FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
CVE-2026-109240 3.1 LOW FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
CVE-2026-109241 3.1 LOW FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
CVE-2026-109247 3.1 LOW FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

IV. Related Vulnerabilities

Same product: FreeRDP
Same vendor: FreeRDP
Same weakness: CWE-416

V. Comments for CVE-2026-109254

No comments yet

Leave a comment