CVE-2026-114042

Received Received - Intake

Use-After-Free in FreeRDP via drdynvc Channel

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114042

EUVD

EUVD-2026-106993

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	3.32.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-114042 is a use-after-free vulnerability in FreeRDP versions 3.24.2 through 3.32.0 affecting the DRDYNVC (Dynamic Virtual Channel) component. A malicious RDP server can send a malformed packet with totalLength smaller than chunk size, causing the client to incorrectly free a pool-owned stream during teardown. This leads to a use-after-free condition where freed memory is later accessed, causing crashes.

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is 3.24.2 through 3.32.0, the system is vulnerable. Monitor network traffic for malformed Virtual Channel PDUs targeting the drdynvc channel.

Impact Analysis

This vulnerability allows a remote attacker to crash the FreeRDP client by sending a single malicious packet. Since no authentication or complex conditions are required, it poses a significant risk for denial-of-service attacks against systems using vulnerable FreeRDP versions. The crash occurs during session teardown, potentially disrupting remote desktop sessions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a client-side use-after-free issue in FreeRDP. However, if exploited, it could lead to denial-of-service conditions during RDP sessions, potentially disrupting secure data transmission or access controls required by these regulations.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.1 or later immediately. If upgrading is not possible, disable the drdynvc channel by setting the environment variable FREERDP_DRVDYNVC=0 or block RDP traffic at the network perimeter until patched.

Hi! I’m here to help you understand CVE-2026-114042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...