CVE-2026-109253
Received Received - Intake

Out-of-Bounds Read in FreeRDP Remote Credential Guard

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109253
EUVD
EUVD-2026-97697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109253 is an out-of-bounds read vulnerability in FreeRDP versions 3.9.0 to 3.31.0. It occurs in the RDPEAR NDR scalar readers where value length checks happen before handling alignment padding. Malicious RDP servers can send crafted unaligned payloads to trigger over-reads, potentially crashing the client process.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions. Run 'xfreerdp --version' or 'freerdp2 --version' on Linux systems. For Windows, check installed program versions via Control Panel or PowerShell with 'Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*FreeRDP*"}'. If versions 3.9.0 to 3.31.1 are installed, the system is vulnerable.

Impact Analysis

This vulnerability allows a malicious or compromised RDP server to crash the FreeRDP client process by sending specially crafted payloads. If the client uses Remote Credential Guard, the attack could lead to denial of service, disrupting remote desktop sessions.

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. Disable Remote Credential Guard if enabled, as it is required for exploitation. Monitor network traffic for untrusted RDP servers sending crafted payloads. Apply vendor patches if available for downstream applications using FreeRDP.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart