CVE-2026-109943: FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients from 3.29.0 up to, but not including, 3.32.0 are affected when the client has +async-update enabled. The attack is delivered by a malicious RDP server, so clients connecting to untrusted or compromised servers are the relevant exposure path.
What must an attacker do to trigger the flaw?
An attacker needs to operate or control an RDP server that the victim connects to. The server sends a polygon order containing points and then a zero-point PolygonSC or PolygonCB order, causing the client to double free the points array.
What is the expected impact of successful exploitation?
The described result is a client crash, producing a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.
What can be done before upgrading?
If upgrading to 3.32.0 is not immediately possible, avoid connecting affected clients with +async-update enabled to untrusted RDP servers. Restrict connections to known, trusted servers where possible.