CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name
A heap buffer over-read in FreeRDP allows malicious RDP servers to leak memory or crash the proxy via malformed channel names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109951?
CVE-2026-109951 is a medium-severity vulnerability in Freerdp Freerdp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.
Weakness: CWE-125
Which versions are affected by CVE-2026-109951?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-109951?
Upgrade to a fixed version.
Is CVE-2026-109951 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109951 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-109951, GHSA-g4wg-67xq-8q53, GHSA-h552-rp6x-j2cx, UBUNTU-CVE-2026-109951.