CVE-2026-109950 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages
A malicious RD Gateway can crash FreeRDP clients by sending mismatched message lengths, causing a heap out-of-bounds read during UTF-8 conversion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109950?
CVE-2026-109950 is a medium-severity memory corruption vulnerability in Freerdp Freerdp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
Weakness: CWE-125
Which versions are affected by CVE-2026-109950?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-109950?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109950 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109950 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-109950, GHSA-6j8x-gjmp-55pr, GHSA-xf45-j844-588v, UBUNTU-CVE-2026-109950.