FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before… (CVE-2026-109253)

An out-of-bounds read vulnerability exists in FreeRDP versions from 3.9.0 before 3.32.0 within the RDPEAR NDR scalar readers. The vulnerability arises because the code checks the value length before consuming alignment padding, which can be exploited by malicious or compromised RDP servers sending specially crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages. This can cause the client process to over-read memory, leading to a crash. The issue specifically impacts clients using Remote Credential Guard. The CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating a medium severity denial of service risk without confidentiality or integrity impact. No patch or vendor advisory details are provided, and no known exploits have been observed in the wild.

The vulnerability can cause a denial of service by crashing the FreeRDP client process when connecting to a malicious or compromised RDP server that sends crafted unaligned RDPEAR payloads. There is no impact on confidentiality or integrity. The attack requires network access and user interaction (UI:R), and the attack complexity is high (AC:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when connecting to untrusted RDP servers, especially when using Remote Credential Guard. No official fix or workaround information is provided in the available data.