Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-109252

Freerdp: null pointer dereference can lead to denial of service

Risk score
41/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing c…
Affected
Freerdp before 3.32.0
Fix
Upgrade Freerdp to 3.32.0 or later.
Exploitation
Public proof of concept

Story map

Story map: FreerdpTHE FLAWSTHE FIXCVE-2026-109252Null pointer dereference canlead to denial of serviceCVSS 5.3 · EPSS 0%CVE-2026-109257Double free can lead to denialof serviceCVSS 7.5 · EPSS 0%CVE-2026-109676Use-after-free can lead todenial of serviceCVSS 8.8 · EPSS 0%CVE-2026-110838Missing authenticationCVSS 7.5 · EPSS 0%Upgrade Freerdp3.32.0or later on your release lineWho is exposedFreerdp before 3.32.0AMBER · PATCH THIS WEEKFreerdpFreeRDP before 3.32.0 containsa double-free vulnerability innsc_context_initialize_encode()that leaves dangling planepointers after a partial buffergrowth failure. Attackers usinga crafted RDP client can…Where it standsPublic proof of conceptCONNECTS TOSame weaknessNull pointer dereference (CWE-476)122 other warnings in 30 days →Same productEarlier Freerdp warnings53 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during con…

The flaws

  • CVE-2026-109252: Null pointer dereference can lead to denial of service (CVSS 5.3 · EPSS 0%)
  • CVE-2026-109257: Double free can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109676: Use-after-free can lead to denial of service (CVSS 8.8 · EPSS 0%)
  • CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Public exploit or proof of concept referenced

References

Original description

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.

Last activity 12 Oct 2026. Patch Forecast updates every hour.