Description
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
Published: 2026-10-12
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

FreeRDP versions prior to 3.32.0 contain a double‑free flaw in the nsc_context_initialize_encode function that leaves dangling plane pointers when a buffer growth operation partially fails. A malicious RDP client can exploit this by requesting the NSCodec codec with a very large desktop geometry, causing an allocation failure during context teardown. The flaw leads to an uncontrolled double free, making the server crash and rendering it unavailable for legitimate users.

Affected Systems

All FreeRDP releases older than version 3.32.0 are affected. The vulnerability is present in the core FreeRDP project and applies to any deployment that uses the default code path for NSCodec plane handling.

Risk and Exploitability

The vulnerability has a CVSS score of 8.2, indicating a high severity. No EPSS data is available, but the attack is remotely reachable via a crafted RDP client and does not require local privileges. The CVE is not listed in the CISA KEV catalog, yet the potential for wide‑area denial of service through a simple RDP session makes it a significant risk to any service relying on FreeRDP for remote desktop connections.

Generated by OpenCVE AI on October 13, 2026 at 13:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to FreeRDP 3.32.0 or later when a patch is released.
  • Configure the FreeRDP server to disable or tightly restrict the NSCodec codec, and enforce a maximum desktop geometry size for incoming connections.
  • Segment RDP traffic so that only trusted clients can reach the server, and monitor for repeated instabilities or excessive crashes that may indicate exploitation attempts.

Generated by OpenCVE AI on October 13, 2026 at 13:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:freerdp:freerdp:3.31.0:*:*:*:*:*:*:*

Thu, 15 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
Title FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-415
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T02:32:16.005Z

Reserved: 2026-10-12T14:10:14.199Z

Link: CVE-2026-109257

cve-icon Vulnrichment

Updated: 2026-10-15T02:32:10.977Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-12T17:17:17.280

Modified: 2026-10-27T18:56:10.953

Link: CVE-2026-109257

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-12T16:04:28Z

Links: CVE-2026-109257 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T13:30:17Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free