FreeRDP CVE-2026-109257

Requires an RDP server built on FreeRDP (versions before 3.32.0) running in server mode with NSCodec support available for negotiation; the attacker acts as a malicious RDP client and must negotiate NSCodec while specifying a sufficiently large desktop geometry to force a buffer-growth allocation failure inside nsc_context_initialize_encode(). Limiting factors: the AT:P metric reflects that success depends on actually inducing the allocation failure (influenced by memory availability/geometry limits), so the trigger is not perfectly deterministic; impact is confined to a crash (availability) with no code execution, data exposure, or persistence; and the vulnerable server-side deployment mode of FreeRDP is less common than its client-side use.

This is a moderate-priority availability-only issue, not a critical one despite the 8.2 CVSS 4.0 base score. The vendor-supplied CVSS:4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated trigger, but crucially scores VC:N/VI:N/VA:H - the only impact is availability (a server crash via CWE-415 double-free). There is no confidentiality or integrity impact and no indication of code execution. The AT:P (attack requirement present) element is significant: exploitation depends on forcing an allocation failure, which is not a guaranteed-success deterministic trigger, lowering practical reliability. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code was referenced - so there is no public exploit identified at time of analysis. Note the directionality: the attacker is a malicious RDP CLIENT and the victim is an RDP SERVER built on FreeRDP, which is the less common deployment mode for this library (FreeRDP is far more widely used as a client). Net: a reliable DoS against exposed FreeRDP-based RDP servers, worth patching on internet-facing or multi-tenant RDP server deployments, but not an urgent RCE-class emergency.

A malicious actor connects to an internet-reachable or otherwise accessible RDP server built on FreeRDP (versions before 3.32.0) using a crafted RDP client. During session negotiation the client requests the NSCodec with an unusually large desktop geometry, forcing a buffer-growth allocation failure in nsc_context_initialize_encode() that leaves dangling plane pointers; on context teardown the resulting double-free crashes the server, denying service to legitimate users. No public exploit code was identified at time of analysis, and the attack causes a crash only - no code execution or data disclosure.