CVE-2026-109257: FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
FreeRDP before 3.32.0 contains a double-free vulnerability in nsccontextinitializeencode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions before 3.32.0 are affected where a server can be reached by an RDP client that can negotiate NSCodec.
What does an attacker need to do to trigger the issue?
An unauthenticated attacker needs to use a crafted RDP client, negotiate NSCodec, and request a large desktop geometry that causes buffer-growth allocation failure.
What is the expected impact of successful exploitation?
The described outcome is a server crash during context teardown, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.
How can I tell whether a system needs remediation?
Check the deployed FreeRDP version. Versions before 3.32.0 should be treated as affected.