FreeRDP CVE-2026-109943

Exploitation requires that the FreeRDP client be started with the non-default +async-update option - the double free lives in the async-update message proxy and does not occur in default client configurations. The victim must also initiate an RDP connection to an attacker-controlled or compromised server, which then sends a PolygonSC or PolygonCB order containing points followed by a second polygon order with numPoints=0 to trigger the shallow-copy double free. Limiting factors: the +async-update flag is off by default; the attacker must control the server side (no attack against a server, only against a connecting client); user interaction is needed to establish the connection; and impact is confined to crashing the client (availability), with no code execution, data disclosure, or integrity loss.

This is a denial-of-service-only flaw (CWE-415 double free) whose real-world priority is modest. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 7.1 and reflects availability-only impact with no confidentiality or integrity loss - consistent with the description of a client crash. Critically, the network vector is a REVERSE one: the victim FreeRDP client must connect to an attacker-controlled or compromised RDP server (UI:P), and the vulnerable code path only exists when the client is explicitly launched with the non-default +async-update option. That configuration dependency is a significant limiter the CVSS base vector does not fully capture (it encodes AC:L/AT:N, i.e. no special attack requirement, which arguably understates the +async-update prerequisite). No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code was identified in the supplied intelligence, so there is no evidence of active or widespread exploitation. Net assessment: a legitimate bug worth patching on the normal cycle, but not an emergency - the combination of DoS-only impact, required malicious-server positioning, and dependency on a non-default flag keeps real-world risk low relative to the 7.1 headline score.

An attacker who operates or has compromised an RDP server (or lures a user to connect via a malicious .rdp file) waits for a FreeRDP client running with +async-update to connect. The server then sends a PolygonSC or PolygonCB drawing order carrying points, immediately followed by a zero-point polygon order, causing both the async-update queue consumer and the parser cleanup to free the same points array and crash the client. No public exploit code was identified at time of analysis.