CVE-2026-109257: FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure

Q: Which deployments are exposed?

FreeRDP versions before 3.32.0 are affected where a server can be reached by an RDP client that can negotiate NSCodec.

Q: What does an attacker need to do to trigger the issue?

An unauthenticated attacker needs to use a crafted RDP client, negotiate NSCodec, and request a large desktop geometry that causes buffer-growth allocation failure.

Q: What is the expected impact of successful exploitation?

The described outcome is a server crash during context teardown, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.

Q: How can I tell whether a system needs remediation?

Check the deployed FreeRDP version. Versions before 3.32.0 should be treated as affected.

Published Oct 12, 2026

Updated

FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

Affected Software

1 affected component

FreeRDP freerdp<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

FreeRDP versions before 3.32.0 are affected where a server can be reached by an RDP client that can negotiate NSCodec.

What does an attacker need to do to trigger the issue?

An unauthenticated attacker needs to use a crafted RDP client, negotiate NSCodec, and request a large desktop geometry that causes buffer-growth allocation failure.

What is the expected impact of successful exploitation?

The described outcome is a server crash during context teardown, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.

How can I tell whether a system needs remediation?

Check the deployed FreeRDP version. Versions before 3.32.0 should be treated as affected.

CVE-2026-109257: FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the issue?

What is the expected impact of successful exploitation?

How can I tell whether a system needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the issue?

What is the expected impact of successful exploitation?

How can I tell whether a system needs remediation?