CVE-2026-109943GHSA-pg3f-chj4-mrw6
FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
FreeRDP FreeRDP
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
Text from CVE List
Affected versions 2
- FreeRDPaffected: 3.29.0 before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List