CVE-2026-109943
Received Received - Intake

Double Free in FreeRDP Client Async-Update

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109943
EUVD
EUVD-2026-98708

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109943 is a double-free vulnerability in FreeRDP versions 3.29.0 to 3.31.1. When the +async-update mode is enabled, a malicious RDP server can send a polygon order with points followed by a zero-point order. This causes the client to shallow-copy the parser's points array, leading both the queue consumer and parser cleanup to free the same memory, resulting in a crash.

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is between 3.29.0 and 3.31.1. Run 'xfreerdp --version' or 'freerdp2 --version' to verify the installed version. If the version falls within the affected range and the +async-update mode is enabled, the system may be vulnerable.

Impact Analysis

This vulnerability can crash FreeRDP clients with +async-update enabled when connecting to a malicious RDP server. It does not require authentication and primarily impacts availability, causing denial-of-service conditions for affected clients.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.0 or later. Disable the +async-update mode if enabled. Avoid connecting to untrusted RDP servers until patched. Monitor for crashes or unusual behavior in FreeRDP clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109943. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart