CVE-2026-109253: FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using FreeRDP versions 3.9.0 through versions before 3.32.0 are affected when they use Remote Credential Guard and connect to a malicious or compromised RDP server. The affected parsing path handles RDPEAR NDR scalar data.
What must an attacker be able to do to trigger the problem?
An attacker needs to operate or compromise an RDP server that a target client connects to, then send a crafted unaligned RDPEAR payload, such as a CreateApReqAuthenticatorReq message. The vector indicates network reachability, no attacker privileges, and required user interaction.
What is the likely impact of successful exploitation?
Crafted data can cause an out-of-bounds read in the client process and potentially crash that process. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.
How can I identify potentially affected systems?
Identify systems running FreeRDP from 3.9.0 to before 3.32.0, then determine whether those clients use Remote Credential Guard. Those clients should be treated as potentially affected when connecting to untrusted or compromised RDP servers.