FreeRDP CVE-2026-109242

Exploitation requires the victim to initiate an RDP connection to an attacker-controlled or man-in-the-middle RDP server (UI:P in the 4.0 vector - the client is the target, not a listening service), and the session must negotiate the RemoteFX/progressive codec so the server can emit the malicious WBT_TILE_FIRST followed by WBT_TILE_UPGRADE sequence against an un-decoded tile. The core prerequisite is the progressive codec code path being reached with a tile->current buffer allocated but not zeroed. Limiting factors: the attacker must control the server side and induce the user to connect (no unauthenticated push against an exposed client port), the affected version must be FreeRDP before 3.0.0 or in the 3.6.0-before-3.32.0 range, and the confidentiality leak is opportunistic (whatever heap happens to be rendered) rather than a targeted read of attacker-chosen memory.

This is a client-side, server-triggered vulnerability: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 7.1 (High), driven almost entirely by the availability impact (VA:H - the client can be aborted) with only low confidentiality impact (VC:L - uninitialized heap bytes are painted onscreen rather than exfiltrated to the attacker in a structured way). PR:N and AV:N look alarming in isolation, but UI:P is the decisive mitigating signal: exploitation is not a push attack against a listening service - the victim must initiate an RDP session to an attacker-controlled or compromised server. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is currently no evidence of active exploitation or available exploit code (no public exploit identified at time of analysis). The practical risk is therefore moderate and conditional: it matters most where users connect to untrusted or man-in-the-middle-able RDP endpoints, and far less for clients that only reach trusted internal servers. Note the information-disclosure value is weak - CWE-908 uninitialized heap rendered to the display is a low-bandwidth, unreliable leak, whereas the crash (denial of service) is the more dependable outcome; the 'Information Disclosure' tag slightly overstates the confidentiality primitive relative to the DoS. No conflicts exist between the CVSS vector and the description - both agree this is a network-reachable, low-complexity, no-privilege, user-interaction-dependent client flaw.

An attacker stands up a malicious RDP server (or MITMs a connection) and waits for or lures a victim to connect using a vulnerable FreeRDP-based client with the progressive codec enabled. During the graphics stream the server sends a crafted WBT_TILE_FIRST followed by a WBT_TILE_UPGRADE sequence referencing an un-decoded tile, causing the client to render the uninitialized tile->current heap buffer onscreen or crash the client. No public exploit code is identified at time of analysis, so this reflects the described mechanism rather than a weaponized tool.