Double Free in FreeRDP Client Async-Update

Executive Summary

CVE-2026-109943 is a double-free vulnerability in FreeRDP versions 3.29.0 to 3.31.1. When the +async-update mode is enabled, a malicious RDP server can send a polygon order with points followed by a zero-point order. This causes the client to shallow-copy the parser's points array, leading both the queue consumer and parser cleanup to free the same memory, resulting in a crash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is between 3.29.0 and 3.31.1. Run 'xfreerdp --version' or 'freerdp2 --version' to verify the installed version. If the version falls within the affected range and the +async-update mode is enabled, the system may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash FreeRDP clients with +async-update enabled when connecting to a malicious RDP server. It does not require authentication and primarily impacts availability, causing denial-of-service conditions for affected clients.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability due to crashes caused by a double-free issue in FreeRDP. While it does not directly expose or leak data, compliance with standards like GDPR or HIPAA could be indirectly affected if system availability is compromised, leading to potential disruptions in processing or accessing sensitive data. However, the vulnerability does not directly violate data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.0 or later. Disable the +async-update mode if enabled. Avoid connecting to untrusted RDP servers until patched. Monitor for crashes or unusual behavior in FreeRDP clients.

Useful 0 Not Useful 0