CVE-2026-110834: FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which FreeRDP deployments are exposed?
Affected deployments use FreeRDP versions from 2.0.0 up to, but not including, 3.32.0 on Linux with serial redirection in use. Clients without Linux serial redirection are not identified as affected by the provided information.
What does an attacker need to exploit this issue?
An attacker needs to operate or control a malicious RDP server that the client connects to. The server sends serial read or write IRPs outside their expected lifecycle, before creation or after closure, to trigger the client crash.
What is the expected security impact?
The reported impact is denial of service: the affected client can terminate. The supplied severity vector indicates no confidentiality or integrity impact.