FreeRDP CVE-2026-109938

Exploitation requires the victim to run a FreeRDP client (version 3.11.0 up to but not including 3.32.0) with video redirection enabled and to actively connect to a malicious or compromised RDP server - the flaw is triggered by a server-sent mapped-video geometry update (UI:P / user-initiated connection). Limiting factors: the attacker must control or compromise the RDP server the user connects to, the vulnerable video-redirection code path must be in use, and impact is confined to a client crash (availability only) with no code execution, data disclosure, or integrity loss. Environments that only connect to trusted internal RDP servers face minimal realistic exposure.

This is a moderate-severity availability-only denial-of-service affecting FreeRDP clients, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly captures that the only impact is availability (VA:H) - a client abort/crash - with no confidentiality or integrity loss, which is why the score sits at 7.1 rather than critical. The key nuance that raw CVSS can obscure is the attack direction: this is a malicious-server-attacks-client (reverse) flaw, so PR:N reflects that the server needs no authentication to the client, but UI:P is load-bearing - the victim must actively initiate a connection to an attacker-controlled or compromised RDP server with video redirection enabled. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a legitimate patch-worthy issue for FreeRDP deployments that connect to untrusted servers, but it is a crash/DoS, not an RCE, and it is gated behind user-initiated connection plus a non-default-ish feature, making it a lower operational priority than its 7.1 might suggest for environments that only connect to trusted internal servers.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a user to connect with a FreeRDP-based client that has video redirection enabled. The server sends a crafted mapped-video geometry update whose positive coordinates trigger an integer overflow (CWE-190), causing the client to abort. No public proof-of-concept is referenced, and because UI:P applies, the attack only fires once the victim initiates the session.