Vulnerability Details CVE-2026-109951
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a NUL byte, causing an unbounded snprintf read that leaks memory into proxy logs or crashes the process.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.7%
CVSS Severity
CVSS v3 Score 5.3