CVE-2026-109943 FreeRDP CVE debrief

Who should care

Defenders responsible for managing and securing RDP clients, particularly those using FreeRDP 3.29.0 before 3.32.0, should assess their exposure and prioritize remediation efforts.

Why it matters

Defenders should prioritize patching or mitigating this vulnerability to prevent potential crashes and ensure the stability of their RDP clients. The vulnerability can be exploited by a malicious RDP server to crash a client with +async-update enabled, and defenders responsible for managing and securing RDP clients should assess their exposure and prioritize remediation efforts.

• Potential crashes and instability of RDP clients
• Need for verification of vulnerability status and remediation efforts
• Potential for exploitation attempts and monitoring requirements

Technical summary

The vulnerability exists in the client's async-update message proxy, where a malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled. This double free vulnerability can be exploited by a malicious RDP server to crash a client with +async-update enabled. The vulnerability is caused by a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential crashes and ensure the stability of their RDP clients.

Recommended defensive actions

• Patch or upgrade FreeRDP to version 3.32.0 or later
• Implement compensating controls, such as monitoring and exception tracking, to detect and respond to potential exploitation attempts
• Verify the vulnerability status of affected systems and prioritize remediation efforts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero. The double free can be triggered when a malicious RDP server sends a point-bearing polygon order followed by a zero-point order. Defenders should verify the vulnerability status of affected systems and prioritize remediation efforts. The vulnerability can be mitigated by patching or upgrading FreeRDP to version 3.32.0 or later. Evidence is limited to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.