CVE-2026-110829: FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions 3.0.0 through versions before 3.32.0 are affected. Exposure occurs when a client using an affected version connects to a malicious RDP server.
What does an attacker need to do to trigger the issue?
The attacker needs to operate or control an RDP server that the victim connects to. The server can send a malformed rdpsnd PDU on a fresh channel with CHANNEL_FLAG_LAST set but CHANNEL_FLAG_FIRST unset.
Is user interaction required?
Yes. A user must connect the affected FreeRDP client to the malicious RDP server; no client privileges are required by the attacker.
What is the impact of successful exploitation?
Successful exploitation crashes the FreeRDP client, causing a denial of service. The provided data does not indicate confidentiality or integrity impact.
How can this be remediated?
Update FreeRDP to version 3.32.0 or later. If updating is not immediately possible, avoid connecting affected clients to untrusted or attacker-controlled RDP servers.