CVE-2026-109242

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109242
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109242.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109242
Aliases
  • GHSA-4mpr-hmqx-83q8
Downstream
Published
2026-10-12T16:04:18Z
Modified
2026-10-13T02:45:54Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade
Details

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-908"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109242.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a34fa7c49d2a39aa49ace1d7bea9656912d8c7cb
Introduced
0d5981c3fd9b4f3e97e358fa9537fbec3fda504d
Fixed
d27a4f7c1c63b62a5e60e5d939ad116cfb58ffc1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.0.0"
        },
        {
            "introduced":  "3.6.0"
        },
        {
            "fixed":  "3.32.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109242.json"