Live › vulnerability › CVE-2026-114042
Go to dashboardFreeRDP 3.32.0 frees a pool-owned stream in the drdynvc channel when totalLength is smaller than the chunk size, causing a use-after-free. A malicious RDP server can send one crafted Virtual Channel PDU to crash the client during teardown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run or ship FreeRDP 3.32.0 clients that connect to RDP servers they do not fully trust. The sources describe the trigger as a malicious server sending a Virtual Channel PDU, so the client side is exposed. unknown for whether the flaw leads beyond a client crash.
No product ranges from the sources yet.
xfreerdp --version or the package manager, and look for 3.32.0.3.32.0 once a fixed release is published; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.
This page as .md · .json · in your agent: get_signal("CVE-2026-114042")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.