FreeRDP: Double free in NSCodec encoder leads to denial of service
Summary
FreeRDP before 3.32.0 contains a double-free vulnerability in the NSCodec encoder (nsc_context_initialize_encode()). After a failed partial buffer growth, dangling plane pointers remain and are freed again during context teardown. A remote attacker using a crafted RDP client can crash a FreeRDP server by requesting a large desktop geometry, but only if the server runs into a memory allocation failure. Code execution has not been demonstrated.
Affected
- FreeRDP 3.31.0 (confirmed by the advisory)
- The CNA record lists all versions below 3.32.0 as affected; earlier releases were not exhaustively tested
Fixed in
- FreeRDP 3.32.0 (per the CNA record and the GitHub advisory GHSA-2hhg-8xx6-v73w)
Workaround
Unknown. No vendor-documented workaround.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV according to the sources
- CISA SSVC lists exploitation as 'poc' (proof of concept exists) and automatable as 'no'
- No public proof of concept was found in the research, which does not prove that none exists
Our recommendation
- Update FreeRDP to 3.32.0 or later, or install the fix from your Linux distribution
- Check your inventory for FreeRDP servers, including appliances and packages such as freerdp3
- Do not expose RDP servers directly to the internet; place them behind a VPN or RD gateway
- Monitor RDP server logs for repeated crashes or unusual connection attempts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2hhg-8xx6-v73w github.com
- VulnCheck Advisory www.vulncheck.com
- FreeRDP 3.32.0 release github.com
- OSV record CVE-2026-109257 osv.dev
- Ubuntu security tracker ubuntu.com
- VulDB entry 417030 vuldb.com
- OpenCVE CVE-2026-109257 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:40.
Original description (NVD)
FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.