CVE-2026-109951: FreeRDP Heap Buffer Overflow Vulnerability

CVE-2026-109951 Overview

CVE-2026-109951 is a heap buffer over-read vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the DynvcTrackerHandleCreateBack function of the freerdp-proxy Dynamic Virtual Channel (DRDYNVC) handler. Versions 3.17.1 through 3.32.0 (exclusive) are affected. A malicious backend RDP server can send a CREATE_REQUEST_PDU whose channel name field lacks a terminating NUL byte. The resulting unbounded snprintf read traverses adjacent heap memory, which can leak that memory into proxy logs or crash the proxy process. The weakness is tracked as CWE-125 (Out-of-Bounds Read).

Critical Impact
A malicious backend RDP server can trigger an out-of-bounds heap read in the FreeRDP proxy, exposing adjacent memory contents through proxy logs or terminating the proxy process.

Affected Products

FreeRDP 3 versions 3.17.1 up to (but not including) 3.32.0
freerdp-proxy component using the DRDYNVC channel tracker
Downstream distributions and applications bundling vulnerable FreeRDP 3 releases

Discovery Timeline

2026-10-13 - CVE-2026-109951 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109951

Vulnerability Analysis

The vulnerability is reachable through the FreeRDP proxy when it brokers a session with a hostile backend server. During dynamic virtual channel setup, the proxy parses a CREATE_REQUEST_PDU sent by the backend. The channel name field in that PDU is expected to be a NUL-terminated string. DynvcTrackerHandleCreateBack passes the channel name buffer to an snprintf-family call that uses %s formatting without an explicit length bound. When the backend omits the NUL terminator, the format routine reads past the end of the heap allocation until it encounters an unrelated zero byte in process memory. The attacker does not need credentials or user interaction, because the proxy processes PDUs from the backend as part of normal session brokering.

Root Cause

The root cause is missing input validation on an attacker-controlled, variable-length string field combined with the use of a C-string formatting primitive that assumes NUL termination. The parser does not verify that the channel name contains a NUL byte within the declared PDU length before passing the pointer to snprintf. This mismatch between protocol-field semantics and C-string semantics produces the out-of-bounds read.

Attack Vector

Exploitation requires an attacker-controlled backend RDP server reachable through a vulnerable freerdp-proxy deployment. The attacker crafts a malformed DRDYNVC CREATE_REQUEST_PDU with a channel name field that omits the terminating NUL byte. When the proxy forwards or processes the message, DynvcTrackerHandleCreateBack reads beyond the allocation. The leaked bytes are written into proxy log output, giving the attacker a channel to exfiltrate heap contents, or the read strays into unmapped memory and crashes the proxy, causing denial of service for all brokered sessions.

No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory for FreeRDP for additional technical detail.

Detection Methods for CVE-2026-109951

Indicators of Compromise

Unexpected freerdp-proxy crashes or restarts correlated with incoming RDP sessions from untrusted backend hosts.
Proxy log entries containing non-printable, binary, or unusually long channel name strings emitted from DynvcTrackerHandleCreateBack.
Repeated DRDYNVC CREATE_REQUEST_PDU messages originating from the same backend before a proxy fault.

Detection Strategies

Inventory hosts running FreeRDP 3 and flag versions 3.17.1 through 3.32.0 (exclusive) using software composition analysis.
Enable verbose logging on freerdp-proxy in test environments and alert on channel-name log fields that contain high-entropy or non-ASCII content.
Monitor process supervisors (systemd, container runtimes) for abnormal termination of the freerdp-proxy service.

Monitoring Recommendations

Forward freerdp-proxy logs and process events into a centralized analytics pipeline for correlation with backend session metadata.
Baseline normal DRDYNVC channel names observed in your environment and alert on deviations in length or encoding.
Track outbound connections from the proxy to backend RDP servers and investigate sessions preceding any proxy crash.

How to Mitigate CVE-2026-109951

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all hosts running freerdp-proxy.
Restrict the set of backend RDP servers the proxy is permitted to contact using allow-lists or network segmentation.
Rotate any secrets or session artifacts that may have been written to proxy logs after exposure to untrusted backends.

Patch Information

The FreeRDP maintainers resolved the issue in release 3.32.0. Fix details and affected code paths are documented in the GitHub Security Advisory GHSA-g4wg-67xq-8q53. Linux distributions should be checked for backported patches to the freerdp2/freerdp3 packages.

Workarounds

Disable the freerdp-proxy service where it is not strictly required until patches are applied.
Place the proxy behind a trust boundary that only permits connections to vetted backend RDP endpoints.
Reduce proxy log verbosity so that channel-name fields are not written to disk, limiting exfiltration value even if the over-read is triggered.

bash

# Verify installed FreeRDP version and upgrade on Debian/Ubuntu
dpkg -l | grep -E 'freerdp|xfreerdp'
sudo apt update && sudo apt install --only-upgrade freerdp3-x11 freerdp3-proxy

# Verify the running proxy binary reports a fixed version (>= 3.32.0)
freerdp-proxy --version