CVE-2026-109254: FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-13
Weakness: CWE-416

Description

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.

Affected products

FreeRDP: from 2.1.0 before 3.32.0 — fixed in 3.32.0

How to fix

Upgrade to a fixed version: FreeRDP 3.32.0. Check the vendor advisory for mitigations.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vqxm-9w7c-hvvx
https://www.vulncheck.com/advisories/freerdp-2.1.0-before-3.32.0-use-after-free-via-rdpsnd-disconnect-path

Get alerted when CVE-2026-109254 or the next vulnerability affects your stack