FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash… (CVE-2026-109252)

The vulnerability in FreeRDP (CVE-2026-109252) is a NULL pointer dereference in the RDPEAR NDR reader component. It occurs when a malicious server sends a CreateApReqAuthenticatorReq message with a NameCount field set to two or more but truncates the data before the Names pointer. This leads to cleanup code dereferencing a null base pointer, causing the FreeRDP client to crash. The affected versions are from 3.9.0 up to but not including 3.32.0. The CVSS v3.1 score is 5.3, indicating a medium severity denial of service impact with network attack vector, high attack complexity, no privileges required, user interaction required, and no confidentiality or integrity impact.

Successful exploitation results in a denial of service condition by crashing the FreeRDP client. There is no impact on confidentiality or integrity. The attack requires a malicious server to send crafted data and user interaction to initiate the connection. The vulnerability does not allow code execution or data compromise but disrupts client availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid connecting to untrusted or potentially malicious RDP servers. Monitoring vendor channels for patches or updates addressing this issue is recommended.