CVE-2026-109252: FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.9.0 up to, but not including, 3.32.0 are affected. Exposure occurs when an affected FreeRDP client connects to a malicious server that sends the crafted RDPEAR data.
What does an attacker need to exploit the vulnerability?
The attacker needs to act as, or control, an RDP server that the victim's FreeRDP client connects to. No attacker authentication is required, but user interaction is required because the client must initiate the connection.
What is the practical impact of successful exploitation?
A malicious server can terminate the FreeRDP client by sending a truncated CreateApReqAuthenticatorReq containing a KERB_RPC_INTERNAL_NAME with a NameCount of at least two and no Names pointer. The provided data describes an availability impact only, not disclosure or modification of data.
How can this be remediated?
Upgrade FreeRDP to version 3.32.0 or later. The affected range begins at version 3.9.0 and ends before 3.32.0.