CVE-2026-109950

4.3 MEDIUMpublic exploit available

Published 2026-10-13 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weaknesses

CWE-125

Public exploit & PoC references

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xf45-j844-588v
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xf45-j844-588v

All references

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xf45-j844-588v
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-out-of-bounds-read-via-rd-gateway-messages
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xf45-j844-588v

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2024-58392PoC
MEDIUMCVE-2024-58397PoC
MEDIUMCVE-2026-100126
MEDIUMCVE-2026-100130
MEDIUMCVE-2026-100131
HIGHCVE-2026-100387PoC
MEDIUMCVE-2026-100505PoC
MEDIUMCVE-2026-101204

Related by shared AI tags and CWE weakness class. Browse the full archive.