Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-109942

FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 2.3.0 to < 3.32.0affected
  • 3.32.0unaffected

References