FreeRDP (3.6.0 - 3.32.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/freerdp-3.6.0---3.32.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:34:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure and DoS in FreeRDP via Heap Memory Leakhttps://feed.craftedsignal.io/briefs/2026-10-freerdp-heap-disclosure/Mon, 12 Oct 2026 18:34:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-freerdp-heap-disclosure/FreeRDP versions before 3.0.0 and 3.6.0 before 3.32.0 are vulnerable to heap memory disclosure and denial-of-service attacks triggered by a malicious RDP server sending crafted progressive tile sequences.FreeRDP versions prior to 3.0.0 and 3.6.0 before 3.32.0 contain a vulnerability where uninitialized heap memory from un-decoded progressive tiles is rendered. This occurs because the tile buffer is allocated without zeroing out memory, allowing an attacker to access sensitive information residing in the heap. A malicious RDP server can exploit this by sending a specifically crafted sequence of WBT_TILE_FIRST and WBT_TILE_UPGRADE messages. Depending on the server's input, the client may render leaked heap bytes directly to the screen or encounter an unhandled memory condition leading to a process crash (Denial of Service). This issue affects all platforms utilizing the affected FreeRDP versions as a remote desktop client.

Impact

Successful exploitation allows a malicious server to view potentially sensitive data stored in the client's heap memory or force the client application to terminate. This poses a risk to users connecting to untrusted RDP servers, as memory contents could be visualized on the client's display.

Recommendation

  • Upgrade to FreeRDP version 3.32.0 or later to ensure heap buffers are properly initialized.
  • Review patch notes for CVE-2026-109242 to verify build requirements.
  • Until patching is possible, restrict RDP client connections to known, trusted servers and avoid connecting to unauthorized or public-facing RDP infrastructure.
]]>highadvisory