Description
FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
Published: 2026-10-12
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

A use‑after‑free bug in the static rdpsnd channel disconnect path allows a remote RDP server to disconnect while the client is processing queued Wave2 playback packets. The bug frees audio format and device objects without stopping the play thread, causing the client to dereference freed heap memory and crash. This can be used to silently terminate a client, creating a denial‑of‑service condition. The weakness matches CWE‑416 and CWE‑825. The impact is limited to a crash of the FreeRDP client, not remote code execution or data exposure.

Affected Systems

FreeRDP 2.1.0 and all earlier releases up to, but not including, 3.32.0 are affected. Users running these versions on any platform that uses the rdpsnd channel should be aware.

Risk and Exploitability

The vulnerability has a CVSS score of 6, indicating moderate severity. No EPSS score is available, and the issue is not listed in CISA KEV. The likely attack vector is an RDP server that intentionally disconnects during asynchronous audio playback; this is inferred because the description states a remote server can disconnect while the client is processing queued Wave2 playback packets. Attackers need control of a RDP server with a client connection to trigger the disconnect while playback is queued, thereby causing a client crash and service interruption.

Generated by OpenCVE AI on October 13, 2026 at 13:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or later to eliminate the use‑after‑free condition
  • If an upgrade is not immediately possible, disable the rdpsnd channel or block audio playback to prevent the use‑after‑free path from being exercised
  • Configure network monitoring or IDS rules to detect anomalous RDP disconnects occurring during playback, and investigate any such events promptly

Generated by OpenCVE AI on October 13, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.
Title FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-416
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:56:42.307Z

Reserved: 2026-10-12T14:09:00.053Z

Link: CVE-2026-109254

cve-icon Vulnrichment

Updated: 2026-10-13T15:49:18.553Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-12T17:17:16.823

Modified: 2026-11-02T20:51:26.767

Link: CVE-2026-109254

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-12T16:04:26Z

Links: CVE-2026-109254 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T14:00:09Z

Weaknesses