Uninitialized Heap Memory Vulnerability in FreeRDP Products by FreeRDP

CVE-2026-109242

What is CVE-2026-109242?

FreeRDP versions prior to 3.0.0 and 3.6.0 before 3.32.0 are impacted by a vulnerability leading to uninitialized heap memory disclosure. This issue occurs due to the allocation of tile buffers without proper zeroing, enabling a malicious RDP server to exploit this flaw. By sending specially crafted sequences, such as WBT_TILE_FIRST followed by WBT_TILE_UPGRADE, an attacker can cause residual heap data to be rendered onscreen or execute an abort on the client process, which may compromise sensitive data and affect application stability.

References