CVE-2026-109254: FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

Q: Which deployments are exposed to this issue?

FreeRDP versions from 2.1.0 before 3.32.0 are affected. Exposure occurs when a FreeRDP client connects to a malicious RDP server that can use the rdpsnd static channel.

Q: What does an attacker need to do to trigger the flaw?

The attacker needs to operate or control an RDP server that the victim connects to. The server disconnects while asynchronous Wave2 audio playback is processing queued PDUs, causing the client to access freed heap memory.

Q: What is the likely impact on an affected client?

The described outcome is a client crash caused by reading freed heap memory. The provided information identifies integrity and availability impact, but does not describe confidentiality impact or code execution.

Q: What should be done if upgrading is not immediately possible?

Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers. The supplied information does not identify a configuration workaround or mitigation beyond updating to 3.32.0 or later.

Published Oct 12, 2026

Updated

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.

Affected Software

1 affected component

FreeRDP freerdp>=2.1.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP versions from 2.1.0 before 3.32.0 are affected. Exposure occurs when a FreeRDP client connects to a malicious RDP server that can use the rdpsnd static channel.

What does an attacker need to do to trigger the flaw?

The attacker needs to operate or control an RDP server that the victim connects to. The server disconnects while asynchronous Wave2 audio playback is processing queued PDUs, causing the client to access freed heap memory.

What is the likely impact on an affected client?

The described outcome is a client crash caused by reading freed heap memory. The provided information identifies integrity and availability impact, but does not describe confidentiality impact or code execution.

What should be done if upgrading is not immediately possible?

Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers. The supplied information does not identify a configuration workaround or mitigation beyond updating to 3.32.0 or later.

CVE-2026-109254: FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the likely impact on an affected client?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the likely impact on an affected client?

What should be done if upgrading is not immediately possible?