CVE-2026-114042: FreeRDP Use-After-Free Vulnerability

CVE-2026-114042 Overview

CVE-2026-114042 is a use-after-free vulnerability [CWE-416] in FreeRDP 3.32.0. The flaw resides in the dynamic virtual channel (drdynvc) handler. The code frees a pool-owned stream using the owned-stream deallocator when the totalLength value is smaller than the chunk size. A malicious Remote Desktop Protocol (RDP) server can send a single well-formed Virtual Channel Protocol Data Unit (PDU) to trigger the condition. The result is a client-side crash during teardown and potential memory corruption. FreeRDP is a widely deployed open source RDP client used by Linux desktops, remote access tools, and virtualization gateways.

Critical Impact
A malicious RDP server can crash any connecting FreeRDP 3.32.0 client with a single crafted Virtual Channel PDU, enabling denial of service and potential memory corruption against workstations and gateways.

Affected Products

FreeRDP 3.32.0
Downstream distributions and applications bundling FreeRDP 3.32.0
Remote desktop clients and gateways statically linking vulnerable libfreerdp builds

Discovery Timeline

2026-10-21 - CVE-2026-114042 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114042

Vulnerability Analysis

The vulnerability lives in FreeRDP's dynamic virtual channel subsystem (drdynvc). This channel multiplexes application data such as audio, clipboard, and device redirection over the RDP transport. FreeRDP reassembles chunked Virtual Channel PDUs using stream buffers that are either pool-owned or caller-owned. The two ownership models require different deallocators.

When a server sends a Virtual Channel PDU whose declared totalLength is smaller than the actual chunk size, the client takes a code path that frees a pool-owned stream using the owned-stream deallocator. The stream is returned to the pool and marked reusable, yet subsequent teardown logic continues to reference the same memory. This produces a classic use-after-free during channel cleanup.

Root Cause

The root cause is inconsistent lifetime handling between the stream pool allocator and the Virtual Channel reassembly code. The length validation does not reject malformed PDUs where totalLength < chunkLength. Instead, the handler proceeds into the error path and releases the stream through the wrong deallocator, violating the pool contract.

Attack Vector

Exploitation requires a victim to initiate an RDP session against an attacker-controlled server. User interaction is required (UI:P), which matches typical RDP workflows where users click a saved connection or receive a link. No authentication is needed on the server side (PR:N). Once the TCP connection is established and dynamic virtual channels are negotiated, the server sends a single crafted PDU that triggers the free. The client crashes during channel teardown, producing availability impact and the potential for memory corruption primitives against the pool allocator.

No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-5xjc-c64q-m8r6 and the VulnCheck Advisory on FreeRDP.

Detection Methods for CVE-2026-114042

Indicators of Compromise

FreeRDP client processes (xfreerdp, wfreerdp, sdl-freerdp) terminating with SIGSEGV or SIGABRT shortly after connecting to an external RDP server.
Core dumps or crash reports referencing drdynvc, Stream_Free, or StreamPool_Return call frames.
Outbound RDP connections (TCP/3389) from endpoints to untrusted or newly registered destinations.

Detection Strategies

Hunt for FreeRDP binary versions equal to 3.32.0 across managed Linux and Windows endpoints via software inventory queries.
Alert on repeated crashes of RDP client processes correlated with outbound sessions to external IPs.
Inspect network telemetry for RDP connections where the server initiates dynamic virtual channel traffic before client-side input is observed.

Monitoring Recommendations

Enable kernel core-dump collection on workstations that routinely use FreeRDP for forensic triage.
Forward application crash events and process-termination telemetry to a central data lake for retrospective hunting.
Monitor egress firewall logs for RDP sessions crossing trust boundaries, especially to residential or cloud-hosted IP ranges.

How to Mitigate CVE-2026-114042

Immediate Actions Required

Inventory all systems running FreeRDP 3.32.0, including bundled copies inside remote access tools and VDI clients.
Restrict outbound RDP (TCP/3389 and TCP/3388) to known corporate gateways using host firewalls and network ACLs.
Instruct users to avoid connecting to untrusted RDP endpoints until patched builds are deployed.

Patch Information

Refer to the GitHub Security Advisory GHSA-5xjc-c64q-m8r6 for the upstream fix and affected version matrix. Rebuild or update distribution packages that statically link libfreerdp once vendor-patched versions are available. Verify downstream applications such as Remmina, GNOME Connections, and Weston RDP against updated FreeRDP builds.

Workarounds

Disable dynamic virtual channels where feasible by invoking the client with /dynamic-resolution:off and omitting /drive, /audio, and /clipboard redirection flags that negotiate drdynvc.
Route all RDP traffic through a trusted broker or gateway that terminates and validates PDUs before forwarding to clients.
Downgrade to a prior FreeRDP 3.x release not affected by the pool-owned stream deallocator regression, following vendor guidance.

bash

# Example: launch xfreerdp without optional redirections that require drdynvc
xfreerdp /v:rdp.example.internal /u:alice /cert:tofu \
  -clipboard -audio-mode:none -drives