CVE-2026-109951

A flaw was found in FreeRDP. When handling dynamic virtual channel requests within the proxy component, the service does not properly verify that incoming channel names are null-terminated. A malicious backend Remote Desktop Protocol (RDP) server can exploit this issue by sending a specially crafted request, triggering an out-of-bounds heap read during string formatting. Successful exploitation can result in a Denial of Service (DoS) by crashing the proxy process or cause information disclosure by leaking heap memory into proxy logs.

This flaw is rated Moderate because an out-of-bounds read in the FreeRDP proxy path can cause limited availability impact. No confidentiality or integrity impact is indicated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not expose freerdp-proxy to untrusted networks. Restrict access with host firewalling and network segmentation.