CVE-2026-109242

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.0.0 FreeRDP versions 3.6.0 through 3.31.0

Description The software renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without being zeroed. A malicious RDP server can exploit this by sending a crafted WBT TILE FIRST followed by a WBT TILE UPGRADE sequence, which may result in heap bytes being painted on the screen or the client process being aborted.

Recommendations Update FreeRDP to version 3.0.0 or later. Update FreeRDP to version 3.32.0 or later.