CVE-2026-109951: FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATEREQUESTPDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments using the freerdp-proxy DRDYNVC channel handler are exposed when they connect to a malicious backend RDP server. The issue is in handling of DRDYNVC CREATE_REQUEST_PDU channel names.
What must an attacker control to trigger the issue?
An attacker needs to operate or control a backend RDP server that can send a CREATE_REQUEST_PDU with a channel name lacking a NUL byte. No authentication or user interaction is required according to the supplied CVSS vector.
What is the practical impact of a successful trigger?
The malformed channel name causes an unbounded snprintf read beyond a heap buffer. This can leak heap memory into proxy logs or crash the FreeRDP proxy process; the provided impact data identifies availability impact but no confidentiality or integrity impact.