CVE-2026-109242

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can trigger an internal assertion failure that terminates the client application or causes uninitialized heap memory to be rendered directly onto the screen. This allows an attacker to cause a Denial of Service (DoS) or disclose sensitive information.

This vulnerability is rated as Important rather than Moderate because a compromised or malicious remote desktop endpoint can trigger an unhandled crash or leak uninitialized process memory to the client display without requiring privileges. In Red Hat Enterprise Linux, FreeRDP packages are primarily utilized to establish outbound remote desktop sessions, meaning exposure depends on connecting to an untrusted server. While the attack occurs over the network, exploitation relies on user interaction to initiate the connection to a rogue host rather than exposing a continuously listening network service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.