FreeRDP CVE-2026-109254

Exploitation requires the victim to initiate an RDP connection to an attacker-controlled or compromised server using a FreeRDP client in the 2.1.0-to-before-3.32.0 range, with the static rdpsnd audio channel negotiated and asynchronous Wave2 playback actively processing queued audio PDUs. The attacker then forces a disconnect during that playback to win a race in which audio formats and the device are freed without joining play_thread. Limiting factors: the attacker must control the server side (not a server-reachable flaw), the user must actively connect (UI:P), and success depends on hitting the disconnect-vs-playback timing window (AT:P), so exploitation is non-deterministic; the impact is a client crash, not code execution.

This is a client-side denial-of-service vulnerability (CWE-416 use-after-free) in FreeRDP's rdpsnd audio channel, and the signals converge on moderate rather than critical risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H) scores 6.0 and correctly reflects the impact profile: no confidentiality loss, minimal integrity effect, but high availability impact (client crash). Crucially, the AT:P (attack requirement present) and UI:P (passive user interaction) metrics capture the two real barriers - exploitation depends on a race condition between the server-initiated disconnect and asynchronous Wave2 PDU processing, and the victim must initiate a connection to the attacker-controlled server. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note the directional nuance: although PR:N marks this 'unauthenticated,' the threat model is inverted from typical RDP CVEs - a MALICIOUS SERVER attacks a connecting CLIENT, not an attacker reaching a server. The realistic outcome per the description and VA:H is a crash, not code execution; the tag set (Denial Of Service, Use After Free, Memory Corruption) is consistent with this. Bottom line: a legitimate-but-not-urgent patch priority - a reliable crash primitive gated by a race window and user-initiated connection, with no observed exploitation.

An attacker stands up or compromises an RDP server and lures a user to connect with a FreeRDP-based client (e.g., via a malicious .rdp file or a rogue remote-desktop endpoint). While the static rdpsnd channel is handling asynchronous Wave2 audio playback of queued PDUs, the server abruptly disconnects, freeing the audio formats and device without joining the play_thread, so the still-running thread dereferences freed heap memory and crashes the client. No public exploit code was identified at time of analysis, and reliability is constrained by the timing race.