FreeRDP CVE-2026-109951

Requires a deployment running the freerdp-proxy component at version 3.17.1 up to (not including) 3.32.0, with the proxy connecting to a backend RDP server that is attacker-controlled or can be influenced/redirected (e.g. a malicious or MITM'd backend) - the attacker is the server side, not an inbound client. The malformed trigger is a DRDYNVC CREATE_REQUEST_PDU carrying a channel name with no terminating NUL byte, processed by DynvcTrackerHandleCreateBack. No authentication or user interaction is needed once that backend path exists. The principal limiting factor is trust direction: environments where the proxy only ever reaches fully trusted backends are not practically exposed, and realized impact is bounded to heap memory disclosure into logs or a process crash (denial of service) rather than code execution.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 base score of 6.9 (MEDIUM) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) flaw whose only scored impact is low availability (VA:L) - i.e. the vendor vector models a crash, not data theft. However, the description explicitly states the over-read 'leaks memory into proxy logs,' which is a confidentiality exposure that the input vector's VC:N does NOT capture; this is a conflict between the stated impact and the scored impact that defenders should note. The key limiting factor is directional: the attacker must be (or control) the BACKEND RDP server the proxy connects to, not an arbitrary internet client - so this is exploitable only where freerdp-proxy routes to untrusted/attacker-influenced servers. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied, so there is no evidence of active or widespread exploitation. Overall: a real defect worth patching on exposed proxy deployments, but absent exploitation signals it ranks below internet-facing critical RCEs.

An attacker who operates or can redirect traffic to a backend RDP server that a FreeRDP proxy (3.17.1-3.31.x) connects to sends a crafted DRDYNVC CREATE_REQUEST_PDU whose channel name omits the terminating NUL byte. When DynvcTrackerHandleCreateBack formats this name, an unbounded snprintf reads past the heap buffer, disclosing adjacent heap memory into the proxy's logs or crashing the proxy process. No public proof-of-concept was provided in the source data.