CVE-2026-109679: FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this crash?
Clients using FreeRDP versions from 3.0.0-beta4 through versions before 3.32.0 are exposed when they connect through a configured ARM gateway that can return the affected response.
What does an attacker need to exploit the issue?
The attacker must control the configured ARM gateway, or otherwise be able to make that gateway return an HTTP 200 response with a zero-length body. Exploitation also requires a client to connect and process that response.
What is the impact of successful exploitation?
A crafted empty HTTP 200 response causes a NULL pointer to be passed to strnlen in arm_handle_request_ok, crashing the connecting FreeRDP client. The provided information indicates an availability impact only, with no confidentiality or integrity impact.
How can I determine whether an incident may be related to this vulnerability?
Investigate FreeRDP client crashes occurring while connecting through an ARM gateway, particularly where the gateway returned HTTP 200 responses with empty bodies. Confirm whether the affected client version is earlier than 3.32.0 and at least 3.0.0-beta4.