CVE-2026-109939
Received Received - Intake

NULL Pointer Dereference in FreeRDP

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109939
EUVD
EUVD-2026-98704

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.27.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in FreeRDP versions 3.27.1 through 3.31.0. It occurs when a client with the non-default Bitmap Cache V3 feature enabled tries to access an uninitialized cache pointer during connection setup. A malicious RDP server can send a crafted Cache Bitmap V3 order to crash the client by triggering this flaw in the update_read_cache_bitmap_v3_order() function.

Detection Guidance

To detect this vulnerability, check if FreeRDP versions 3.27.1 through 3.31.0 are installed and if the Bitmap Cache V3 feature is enabled on the client side. Use commands like 'freerdp /version' to check the version and 'ps aux | grep freerdp' to verify running processes with Bitmap Cache V3 enabled.

Impact Analysis

The impact is limited to denial of service. If exploited, the FreeRDP client process will terminate during connection establishment, causing the application to crash. This only affects users who have explicitly enabled the Bitmap Cache V3 feature using the /cache:codec:<rfx|nsc|jpeg> option.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.0 or later. Disable the Bitmap Cache V3 feature by removing the /cache:codec:<rfx|nsc|jpeg> option if enabled. Ensure RDP servers are trusted to prevent malicious connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart