CVE-2026-109951
Received Received - Intake

Heap Buffer Over-Read in FreeRDP Proxy DRDYNVC Channel

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109951
EUVD
EUVD-2026-98655

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.17.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer over-read vulnerability in FreeRDP's proxy component. It occurs when a malicious backend RDP server sends a specially crafted DRDYNVC CREATE_REQUEST_PDU with a channel name missing a NUL terminator. This causes the freerdp-proxy process to read heap memory out of bounds, potentially leaking up to ~63 bytes of memory or crashing the process.

Detection Guidance

To detect this vulnerability, monitor FreeRDP proxy logs for crashes or unusual memory read errors. Use AddressSanitizer (ASan) to compile FreeRDP proxy with sanitizer flags like -fsanitize=address to catch heap buffer over-reads during runtime. Check for malformed DRDYNVC CREATE_REQUEST_PDUs with channel names missing NUL terminators.

Impact Analysis

The impact is limited but includes potential memory disclosure of sensitive data in proxy logs or process crashes. It requires an attacker-controlled backend RDP server and only affects systems running the freerdp-proxy component with untrusted servers. Plain FreeRDP clients and servers are unaffected.

Mitigation Strategies

Upgrade FreeRDP proxy to version 3.32.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict untrusted backend RDP servers from connecting to the proxy or disable the DRDYNVC channel handler if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart