ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109257

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure.

Published Oct 12, 2026 · updated Oct 15, 2026

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

  2. Oct 14, 2026 · NIST NVD

    Updated

    FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

  3. Oct 15, 2026 · NIST NVD

    Updated

    FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.

Affected

  • unmanaged https://github.com|freerdp/freerdpversion unspecified

Sources

  • CVE.orgCVE-2026-109257

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-109257

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2026-109257

    FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation

    nvd.nist.gov
  • Snyk Vulnerability DatabaseSNYK-UNMANAGED-FREERDPFREERDP-20848909

    Double Free

    security.snyk.io

References