Vulnerability Details CVE-2026-109943
FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points array when numPoints is zero, so both the queue consumer and parser cleanup free it. A malicious RDP server can send a point-bearing polygon order followed by a zero-point order to crash a client with +async-update enabled.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 19.0%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-109943
-
cpe:2.3:a:freerdp:freerdp:3.29.0
-
cpe:2.3:a:freerdp:freerdp:3.30.0
-
cpe:2.3:a:freerdp:freerdp:3.31.0
-
cpe:2.3:a:freerdp:freerdp:3.31.1