CVE-2026-109253

5.3Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-125

Impact

A malicious or compromised RDP server can crash your FreeRDP client process by triggering an out-of-bounds read. To exploit this, the attacker needs you to connect to their server with Remote Credential Guard enabled.

Root cause

The RDPEAR NDR scalar reader checks value lengths before accounting for alignment padding, leading to an over-read on crafted payloads.

Affected systems

FreeRDP 3.9.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading must wait, avoid connecting to untrusted RDP servers or disable Remote Credential Guard.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109253