CVE-2026-109241 Overview
CVE-2026-109241 is a NULL pointer dereference vulnerability in FreeRDP versions prior to 3.32.0. The flaw resides in the client-side video redirection channel. A malicious Remote Desktop Protocol (RDP) server can send out-of-order channel messages that cause the FreeRDP client process to crash. Specifically, the server sends a Geometry CLEAR message that nulls the presentation->geometry pointer, then follows with a VideoData message that dereferences the now-NULL pointer. The result is a client-side denial of service. The vulnerability is tracked under CWE-476: NULL Pointer Dereference and requires user interaction to connect to the attacker-controlled server.
Critical Impact
A malicious RDP server can crash connected FreeRDP clients, producing a denial-of-service condition against users who initiate sessions to attacker-controlled hosts.
Affected Products
- FreeRDP versions prior to 3.32.0
- FreeRDP client video redirection channel component
- Downstream applications and distributions that embed vulnerable FreeRDP builds
Discovery Timeline
- 2026-10-12 - CVE-2026-109241 published to the National Vulnerability Database (NVD)
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-109241
Vulnerability Analysis
The vulnerability stems from improper state handling in the FreeRDP client video redirection channel. The channel maintains a presentation structure that holds a geometry pointer used to describe the video surface. When the server issues a Geometry CLEAR message, the client releases the geometry object and sets presentation->geometry to NULL. The channel does not validate that the geometry pointer is non-NULL before servicing subsequent VideoData messages. When the attacker sends VideoData after the CLEAR, the client dereferences the NULL pointer and terminates. This is a protocol-state ordering bug rather than a memory corruption primitive, so the practical impact is confined to denial of service against the client process.
Root Cause
The root cause is missing input and state validation in the video redirection message handler. The handler trusts the server's message sequence and does not re-check presentation->geometry before dereferencing it in the VideoData code path. CWE-476 classifies this exact pattern: use of a pointer that an earlier branch may have set to NULL.
Attack Vector
Exploitation requires a victim to initiate an RDP session to an attacker-controlled or compromised server. The attacker does not need credentials on the client system. The server sends a crafted Geometry CLEAR message followed by a VideoData message on the video redirection virtual channel. The client crashes, dropping the session and terminating any other FreeRDP-dependent work in that process. There is no public proof-of-concept, no entry on the CISA Known Exploited Vulnerabilities catalog, and no evidence of exploitation in the wild. See the GitHub Security Advisory GHSA-x7v7-9jp5-wqj2 for upstream technical details.
No verified exploit code is published. The vulnerability mechanism is described in the Vulncheck advisory for FreeRDP.
Detection Methods for CVE-2026-109241
Indicators of Compromise
- Unexpected FreeRDP client process termination shortly after a session negotiates the video redirection dynamic virtual channel.
- Crash dumps or core files from freerdp, wfreerdp, xfreerdp, or sdl-freerdp referencing the video redirection channel handler.
- Outbound RDP connections from endpoints to untrusted or newly observed external hosts on TCP 3389.
Detection Strategies
- Inventory installed FreeRDP binaries and libraries, then compare reported versions against the fixed release 3.32.0.
- Alert on repeated short-lived RDP sessions from the same client to the same external destination, which may indicate crash-and-retry behavior.
- Correlate application crash telemetry (Windows Error Reporting, coredumpctl, systemd-coredump) with recent outbound RDP connections.
Monitoring Recommendations
- Monitor process termination events for FreeRDP client binaries and capture parent process context for forensic review.
- Log and review outbound RDP connections initiated by end-user workstations, especially to internet destinations.
- Track package manager and software distribution events for FreeRDP updates to confirm patch rollout across the fleet.
How to Mitigate CVE-2026-109241
Immediate Actions Required
- Upgrade FreeRDP to version 3.32.0 or later on all client systems and in any application that bundles FreeRDP.
- Restrict outbound RDP connections from end-user workstations to a reviewed allowlist of trusted internal servers.
- Advise users not to connect to RDP endpoints received by email, chat, or other untrusted channels.
Patch Information
The FreeRDP project fixed the issue in release 3.32.0. Users should update directly from the upstream project or through their Linux distribution, package manager, or vendor update channel. Full remediation details are documented in GHSA-x7v7-9jp5-wqj2.
Workarounds
- Disable the video redirection dynamic virtual channel at FreeRDP client invocation when the feature is not required.
- Enforce egress firewall rules that block RDP traffic to untrusted destinations on TCP 3389.
- Rebuild and redistribute any internal applications that statically link or vendor FreeRDP so they consume the fixed release.
# Example: launch xfreerdp without the video redirection dynamic channel
xfreerdp /v:rdp.internal.example.com /u:alice -video
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
