Heap Buffer Over-Read Vulnerability in FreeRDP by FreeRDP

CVE-2026-109951

What is CVE-2026-109951?

The FreeRDP software versions between 3.17.1 and 3.32.0 contain a heap buffer over-read vulnerability in the DynvcTrackerHandleCreateBack function of the freerdp-proxy DRDYNVC channel handler. This vulnerability can be exploited by malicious backend RDP servers through a CREATE_REQUEST_PDU with an improperly terminated channel name, leading to an unbounded snprintf read. Consequently, sensitive memory information may be leaked into the proxy logs, and in certain scenarios, this can result in the crashing of the FreeRDP process.

References