CVE-2026-109252: FreeRDP NULL Pointer Dereference Vulnerability

CVE-2026-109252 Overview

CVE-2026-109252 is a NULL pointer dereference vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP versions from 3.9.0 before 3.32.0 and resides in the Remote Desktop Protocol Extension for Authentication Redirection (RDPEAR) Network Data Representation (NDR) reader. A malicious RDP server can send a crafted CreateApReqAuthenticatorReq message with a truncated KERB_RPC_INTERNAL_NAME structure, triggering a NULL pointer dereference during cleanup. The result is a client-side crash, producing a denial-of-service condition against FreeRDP clients that connect to attacker-controlled servers. The vulnerability maps to [CWE-476: NULL Pointer Dereference].

Critical Impact
A malicious RDP server can crash any FreeRDP client between 3.9.0 and 3.32.0 by sending truncated RDPEAR Kerberos authentication data.

Affected Products

FreeRDP versions 3.9.0 through 3.31.x
Applications and distributions bundling vulnerable FreeRDP libraries
RDP clients built on FreeRDP with RDPEAR channel support enabled

Discovery Timeline

2026-10-12 - CVE-2026-109252 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109252

Vulnerability Analysis

The vulnerability exists in the RDPEAR channel's NDR deserialization logic. RDPEAR carries Kerberos remote procedure call (RPC) structures between an RDP client and server, enabling authentication redirection. One such structure, KERB_RPC_INTERNAL_NAME, contains a NameCount field followed by a Names array pointer and the array contents.

When a malicious server sends a CreateApReqAuthenticatorReq message where the serialized KERB_RPC_INTERNAL_NAME ends before the Names pointer is deserialized but declares a NameCount of two or more, the reader fails to allocate or populate the Names base pointer. The structure's cleanup routine then iterates over the declared NameCount entries and dereferences the uninitialized or NULL base pointer, terminating the client process.

Root Cause

The RDPEAR NDR reader does not validate that enough bytes remain in the stream to populate the Names array before accepting the declared NameCount. The subsequent cleanup path assumes the base pointer is valid whenever NameCount is non-zero, without checking initialization state. This mismatch between parser error handling and resource cleanup produces the dereference condition described in [CWE-476].

Attack Vector

Exploitation requires a FreeRDP client to connect to a malicious or compromised RDP server. User interaction is required because the client must initiate the session. Once connected, the server returns a crafted RDPEAR payload containing the truncated KERB_RPC_INTERNAL_NAME with NameCount >= 2. The impact is limited to availability: the client process crashes, interrupting active sessions. No code execution, information disclosure, or integrity impact is reported.

Technical details are available in the GitHub Security Advisory GHSA-93g7-296p-j77j and the VulnCheck Advisory on FreeRDP.

Detection Methods for CVE-2026-109252

Indicators of Compromise

Unexpected FreeRDP client process termination shortly after an RDP session establishes authentication redirection
RDP sessions terminating during the RDPEAR channel negotiation phase
Crash dumps referencing the FreeRDP RDPEAR NDR reader or KERB_RPC_INTERNAL_NAME cleanup frames

Detection Strategies

Inventory endpoints for FreeRDP binaries and shared libraries at versions 3.9.0 through 3.31.x
Correlate RDP outbound connections with subsequent FreeRDP process crashes in endpoint telemetry
Flag RDP connections to servers outside sanctioned infrastructure, particularly those triggering abnormal session durations

Monitoring Recommendations

Collect application crash events and watch for repeated FreeRDP client terminations across users
Monitor egress to TCP/3389 and alert on connections to unapproved destinations
Track package versions of FreeRDP across Linux distributions and third-party RDP clients that embed it

How to Mitigate CVE-2026-109252

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all affected endpoints
Audit third-party applications that statically link or bundle FreeRDP and apply vendor updates when available
Restrict outbound RDP connections to approved internal servers using firewall or proxy policy

Patch Information

The FreeRDP maintainers resolved the issue in version 3.32.0. The fix is documented in GitHub Security Advisory GHSA-93g7-296p-j77j. Linux distributions and downstream projects that package FreeRDP should rebuild against the patched release.

Workarounds

Disable the RDPEAR channel at the client where configuration options allow, preventing deserialization of the vulnerable structure
Limit RDP client use to connections against trusted, internally managed servers until patching is complete
Enforce network segmentation that blocks FreeRDP clients from reaching untrusted RDP endpoints on the internet

bash

# Verify installed FreeRDP version and upgrade on Debian/Ubuntu
dpkg -l | grep -i freerdp
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Verify installed FreeRDP version and upgrade on RHEL/Fedora
rpm -qa | grep -i freerdp
sudo dnf upgrade freerdp

# Confirm patched version (expect 3.32.0 or later)
xfreerdp3 --version