CVE-2026-109939: FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which clients are exposed in practice?
Affected FreeRDP clients are those from 3.27.1 before 3.32.0 that have explicitly enabled the non-default Bitmap Cache V3 feature using /cache:codec:<rfx|nsc|jpeg>. Clients not using that feature are not described as affected.
What does an attacker need to exploit this?
An attacker needs to operate or compromise an RDP server that a vulnerable client connects to. During connection setup, the server can send a crafted Cache Bitmap V3 order and crash the client; no client-side privileges are required, but the user must initiate the connection.
What can be done before updating?
Disable the Bitmap Cache V3 option by avoiding /cache:codec:<rfx|nsc|jpeg> when invoking FreeRDP. This prevents use of the non-default feature implicated in the crash.
How can I determine whether a deployment is affected?
Check whether the installed FreeRDP version is 3.27.1 or later but earlier than 3.32.0, and inspect connection commands or configuration for /cache:codec:rfx, /cache:codec:nsc, or /cache:codec:jpeg. Both the affected version range and enabled Bitmap Cache V3 feature are required by the provided information.