CVE-2026-109252
Received Received - Intake

NULL Pointer Dereference in FreeRDP

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109252
EUVD
EUVD-2026-97696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in FreeRDP versions 3.9.0 to 3.31.1. It occurs when a malicious server sends truncated KERB_RPC_INTERNAL_NAME data to a client. The client's RDPEAR NDR reader processes a CreateApReqAuthenticatorReq message with a NameCount of two or more but ending before the Names pointer. During cleanup, the client tries to dereference a null base pointer, causing it to crash.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP client crashes during RDPEAR NDR processing. Check system logs for segmentation faults in FreeRDP processes. Use network traffic analysis tools like Wireshark to inspect for malformed KERB_RPC_INTERNAL_NAME packets with NameCount values greater than one but truncated before the Names pointer.

Impact Analysis

This vulnerability allows attackers to crash FreeRDP clients by sending specially crafted packets. While it does not enable arbitrary code execution or data theft, it can disrupt services relying on FreeRDP for remote desktop access. Users may experience unexpected client terminations when connecting to untrusted servers.

Compliance Impact

This vulnerability causes FreeRDP clients to crash due to a NULL pointer dereference, which may lead to denial-of-service conditions. While it does not directly expose data, service disruptions could impact compliance with GDPR (availability requirements) or HIPAA (system integrity and availability). Organizations using affected FreeRDP versions may face compliance risks if crashes disrupt critical operations.

Mitigation Strategies
  • Upgrade FreeRDP to version 3.32.0 or later to patch the NULL pointer dereference issue.
  • Disable RDPEAR NDR processing if not required by your FreeRDP configuration.
  • Monitor network traffic for suspicious packets targeting FreeRDP clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart