CVE-2026-109950
Publication date 13 October 2026
Last updated 14 October 2026
Ubuntu priority
Description
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages, causing UTF-8 conversion to read past the stream allocation and disrupt client availability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| freerdp2 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| freerdp3 | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1
|
|
| 24.04 LTS noble |
Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1
|
|
| 22.04 LTS jammy | Not in release |
Severity score breakdown
CVSS version:
Base score
5.3 · Medium
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Base score
4.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L