Double Free Vulnerability in FreeRDP Client Async-Update Message Proxy

CVE-2026-109943

What is CVE-2026-109943?

FreeRDP versions 3.29.0 to 3.31.0 contain a critical vulnerability involving a double free issue in the async-update message proxy. When the server sends an initial point-bearing polygon order followed by a zero-point order, the client can be forced to crash. This occurs because the vulnerability allows both the queue consumer and parser to release the same memory allocation due to improper handling of zero-point scenarios. Exploitation of this vulnerability could allow an attacker to disrupt the service of clients using +async-update functionality.

References