CVE-2026-109241
Received Received - Intake

NULL Pointer Dereference in FreeRDP Client Video Redirection

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, causing client denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109241
EUVD
EUVD-2026-97685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.0 has a NULL pointer dereference flaw in the client video redirection channel. Malicious servers can crash clients by sending messages out of order. Specifically, a Geometry CLEAR message nulls the presentation geometry pointer, and a subsequent VideoData message dereferences it, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP client connections for out-of-order video redirection messages. Check FreeRDP version with 'xfreerdp --version' and inspect logs for crashes during video redirection. Monitor network traffic for Geometry CLEAR messages without prior Geometry CREATE.

Impact Analysis

This vulnerability allows attackers to crash FreeRDP clients by exploiting the video redirection channel. If exploited, it can disrupt services relying on FreeRDP, causing temporary unavailability. Users may experience client crashes when connecting to malicious servers.

Compliance Impact

This vulnerability primarily impacts availability, which may affect compliance with regulations requiring system availability like HIPAA for healthcare systems. GDPR focuses on data confidentiality and integrity, so this issue has limited direct impact unless it leads to service disruptions affecting data access.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Avoid using the /video client option as a temporary workaround. Monitor for crashes in FreeRDP clients and block untrusted RDP servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart