FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is… (CVE-2026-109242)

The vulnerability in FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 arises because the tile->current buffer used for rendering progressive tiles is allocated without zeroing, leading to rendering of uninitialized heap memory. A malicious RDP server can exploit this by sending a crafted sequence of WBT_TILE_FIRST followed by WBT_TILE_UPGRADE messages, which results in heap memory bytes being painted onscreen or causes the client process to abort unexpectedly. This is classified under CWE-908 (Use of Uninitialized Resource).

An attacker controlling a malicious RDP server can exploit this vulnerability to cause information leakage by rendering uninitialized heap memory contents on the client screen, potentially exposing sensitive data. Additionally, the crafted input can cause the client process to abort, resulting in a denial of service condition. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when connecting to untrusted RDP servers. No vendor advisory or patch links are provided in the current data.