CVE-2026-109254

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.1.0 through 3.31.0

Description A use-after-free issue exists in the static rdpsnd channel disconnect path. This occurs when audio formats and the device are freed without joining the play thread (a thread responsible for audio playback). A malicious RDP server can trigger this by disconnecting while asynchronous Wave2 playback processes queued PDUs (Protocol Data Units, which are the basic units of data transmitted over a network), leading the client to read freed heap memory and crash.

Recommendations Update FreeRDP to version 3.32.0 or later.