CVE-2026-109942: FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSECHANNEL header to crash a connecting FreeRDP client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients from version 2.3.0 before 3.32.0 are exposed when connecting through an RD Gateway. The issue is triggered by a malicious or compromised RD Gateway sending a malformed close-channel packet.
What does an attacker need to do to exploit it?
An attacker needs control of, or the ability to compromise, an RD Gateway used by the target FreeRDP client. They can then send an eight-byte header-only PKT_TYPE_CLOSE_CHANNEL packet during the connection.
What is the impact on an affected client?
The malformed packet causes FreeRDP to dereference a NULL stream in rdg_process_close_packet, crashing the connecting client. The provided information indicates an availability impact only.
How can I determine whether a client is affected?
Check whether the installed FreeRDP version is 2.3.0 or later but earlier than 3.32.0, and whether it connects through an RD Gateway. A client crash while processing a gateway close-channel packet is consistent with this issue.