CVE-2026-109257 — FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attacker…
Published: 2026-10-12 · CVSS: 8.2 · CVSS 4.0
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7