CVE-2026-109242: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade

Q: Who can exploit this issue?

A malicious RDP server can exploit a vulnerable FreeRDP client. The attacker does not need privileges on the client, but a user must initiate or interact with an RDP connection to the malicious server.

Q: What does an attacker need to send?

The server must send a crafted progressive-codec tile sequence consisting of WBT_TILE_FIRST followed by WBT_TILE_UPGRADE. This can cause uninitialized heap bytes to be rendered onscreen or cause the client process to abort.

Q: Which FreeRDP versions are affected?

Affected versions are FreeRDP releases before 3.0.0, and versions from 3.6.0 before 3.32.0. The provided information does not identify affected versions between 3.0.0 and 3.6.0.

Published Oct 12, 2026

Updated

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBTTILEFIRST then WBTTILEUPGRADE sequence to paint heap bytes onscreen or abort the client process.

Affected Software

1 affected component

FreeRDP freerdp<3.0.0, >=3.6.0<3.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A malicious RDP server can exploit a vulnerable FreeRDP client. The attacker does not need privileges on the client, but a user must initiate or interact with an RDP connection to the malicious server.

What does an attacker need to send?

The server must send a crafted progressive-codec tile sequence consisting of WBT_TILE_FIRST followed by WBT_TILE_UPGRADE. This can cause uninitialized heap bytes to be rendered onscreen or cause the client process to abort.

Which FreeRDP versions are affected?

Affected versions are FreeRDP releases before 3.0.0, and versions from 3.6.0 before 3.32.0. The provided information does not identify affected versions between 3.0.0 and 3.6.0.

CVE-2026-109242: FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

Which FreeRDP versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to send?

Which FreeRDP versions are affected?