CVE-2026-109254: FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 2.1.0 before 3.32.0 are affected. Exposure occurs when a FreeRDP client connects to a malicious RDP server that can use the rdpsnd static channel.
What does an attacker need to do to trigger the flaw?
The attacker needs to operate or control an RDP server that the victim connects to. The server disconnects while asynchronous Wave2 audio playback is processing queued PDUs, causing the client to access freed heap memory.
What is the likely impact on an affected client?
The described outcome is a client crash caused by reading freed heap memory. The provided information identifies integrity and availability impact, but does not describe confidentiality impact or code execution.
What should be done if upgrading is not immediately possible?
Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers. The supplied information does not identify a configuration workaround or mitigation beyond updating to 3.32.0 or later.