CVE-2026-114042

A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects FreeRDP 3.32.0 only (fixed in 3.32.1).

This issue is rated Moderate because a user must connect to a malicious RDP server (UI:R) and the demonstrated impact is a client crash (availability only), with no confirmed confidentiality or integrity impact. Upstream identifies FreeRDP 3.32.0 as the affected version. Red Hat Enterprise Linux ships FreeRDP 2.x (RHEL 8/9) or 3.10.x (RHEL 10), not 3.32.0, so Red Hat products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.