Information Disclosure and DoS in FreeRDP via Heap Memory Leak

FreeRDP versions prior to 3.0.0 and 3.6.0 before 3.32.0 contain a vulnerability where uninitialized heap memory from un-decoded progressive tiles is rendered. This occurs because the tile buffer is allocated without zeroing out memory, allowing an attacker to access sensitive information residing in the heap. A malicious RDP server can exploit this by sending a specifically crafted sequence of WBT_TILE_FIRST and WBT_TILE_UPGRADE messages. Depending on the server's input, the client may render leaked heap bytes directly to the screen or encounter an unhandled memory condition leading to a process crash (Denial of Service). This issue affects all platforms utilizing the affected FreeRDP versions as a remote desktop client.

Impact

Successful exploitation allows a malicious server to view potentially sensitive data stored in the client's heap memory or force the client application to terminate. This poses a risk to users connecting to untrusted RDP servers, as memory contents could be visualized on the client's display.

Recommendation

• Upgrade to FreeRDP version 3.32.0 or later to ensure heap buffers are properly initialized.
• Review patch notes for CVE-2026-109242 to verify build requirements.
• Until patching is possible, restrict RDP client connections to known, trusted servers and avoid connecting to unauthorized or public-facing RDP infrastructure.