Use-After-Free Vulnerability in FreeRDP by FreeRDP Team
CVE-2026-114042

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114042?

FreeRDP 3.32.0 is susceptible to a use-after-free vulnerability within the drdynvc channel, which occurs when a stream allocated by the pool is erroneously freed during server-client interactions. Specifically, if a malicious RDP server sends a carefully crafted Virtual Channel PDU where the total length is less than the expected chunk size, it can inadvertently trigger this flaw, leading to unexpected crashes during session teardown. This vulnerability can significantly disrupt user sessions and expose the client to further risks.

Affected Version(s)

FreeRDP 3.32.0 < 3.32.1

FreeRDP 3.32.1

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.32.0-use-a...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael-JRead
.