{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114042", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:41:06.179Z", "datePublished": "2026-10-21T00:36:22.092Z", "dateUpdated": "2026-10-21T00:36:22.092Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:36:22.092Z"}, "datePublic": "2026-10-05T00:00:00.000Z", "title": "FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU", "descriptions": [{"lang": "en", "value": "FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "defaultStatus": "unaffected", "versions": [{"version": "3.32.0", "status": "affected", "versionType": "semver", "lessThan": "3.32.1"}, {"version": "3.32.1", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.32.1", "versionStartIncluding": "3.32.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5xjc-c64q-m8r6", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-5xjc-c64q-m8r6)"}, {"name": "VulnCheck Advisory: FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/freerdp-3.32.0-use-after-free-via-drdynvc-virtual-channel-pdu"}], "credits": [{"lang": "en", "value": "Michael-JRead", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FreeRDP", "vendor": "FreeRDP", "versions": [{"lessThan": "3.32.1", "status": "affected", "version": "3.32.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.32.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown."}], "id": "CVE-2026-114042", "lastModified": "2026-10-21T01:17:26.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-21T01:17:26.513", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5xjc-c64q-m8r6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/freerdp-3.32.0-use-after-free-via-drdynvc-virtual-channel-pdu"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "freerdp: FreeRDP: use-after-free in drdynvc virtual channel PDU handling", "id": "2558027", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558027"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects FreeRDP 3.32.0 only (fixed in 3.32.1)."], "mitigation": {"lang": "en:us", "value": "Red Hat Enterprise Linux FreeRDP packages do not ship the affected 3.32.0 release and require no update for this CVE.\nWhere FreeRDP 3.32.0 is installed (for example interim Fedora builds), upgrade to 3.32.1 or later.\nDo not connect FreeRDP clients to untrusted RDP servers ([CME-202](https://cmetaxonomy.org/entries/CME-202.html), [CME-203](https://cmetaxonomy.org/entries/CME-203.html)).\nProcess/cgroup limits can contain host impact from a crashed client but do not prevent the DoS ([CME-114](https://cmetaxonomy.org/entries/CME-114.html), [CME-704](https://cmetaxonomy.org/entries/CME-704.html))."}, "name": "CVE-2026-114042", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-21T00:36:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114042\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5xjc-c64q-m8r6\nhttps://www.vulncheck.com/advisories/freerdp-3.32.0-use-after-free-via-drdynvc-virtual-channel-pdu"], "statement": "This issue is rated Moderate because a user must connect to a malicious RDP server (UI:R) and the demonstrated impact is a client crash (availability only), with no confirmed confidentiality or integrity impact. Upstream identifies FreeRDP 3.32.0 as the affected version. Red Hat Enterprise Linux ships FreeRDP 2.x (RHEL 8/9) or 3.10.x (RHEL 10), not 3.32.0, so Red Hat products are not affected. Fedora has moved to 3.32.1 or later and is not affected.", "threat_severity": "Moderate"}

{}