CVE-2026-109242: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort the client process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious RDP server can exploit a vulnerable FreeRDP client. The attacker does not need privileges on the client, but a user must initiate or interact with an RDP connection to the malicious server.
What does an attacker need to send?
The server must send a crafted progressive-codec tile sequence consisting of WBT_TILE_FIRST followed by WBT_TILE_UPGRADE. This can cause uninitialized heap bytes to be rendered onscreen or cause the client process to abort.
Which FreeRDP versions are affected?
Affected versions are FreeRDP releases before 3.0.0, and versions from 3.6.0 before 3.32.0. The provided information does not identify affected versions between 3.0.0 and 3.6.0.