Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 3.0.0-beta4 to < 3.32.0affected
  • 3.32.0unaffected

References