CVE-2026-109939 in FreeRDP
Summary
by MITRE • 10/13/2026
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised RDP server can send a Cache Bitmap V3 order during connection setup to crash a connecting client that has enabled the non-default Bitmap Cache V3 feature (/cache:codec:<rfx|nsc|jpeg>).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical stability issue rooted in improper initialization sequencing within the Remote Desktop Protocol client implementation. Specifically, the flaw resides in the update_read_cache_bitmap_v3_order function located in the libfreerdp/core/orders.c source file. This component is responsible for handling Cache Bitmap V3 orders, which are used to optimize graphical rendering by caching frequently drawn bitmaps on the client side. The core technical defect occurs when a server sends a Cache Bitmap V3 order during the initial connection setup phase, specifically before the Demand Active sequence has completed and initialized the bitmap cache structures. Under normal operational conditions, these caches should only be accessed after they have been properly allocated and prepared by the client software. However, due to this logical error in state management, the application attempts to access a NULL pointer when it tries to write or read from an uninitialized cache entry.
This null pointer dereference is triggered under specific configuration circumstances that are not enabled by default but can be activated by users requiring enhanced performance for certain compression codecs such as RFX, NSC, or JPEG via the /cache:codec command-line flag. When a malicious or compromised Remote Desktop Protocol server exploits this condition, it sends a specially crafted Cache Bitmap V3 order immediately upon connection establishment. The FreeRDP client processes this instruction without verifying that the underlying bitmap cache infrastructure is ready to accept data. Consequently, the application attempts to dereference a null pointer, leading to an immediate segmentation fault and process termination. This results in a denial of service against the connecting user, effectively crashing the remote desktop session and disrupting productivity or access to critical systems relying on this client software.
From a threat modeling perspective, this vulnerability aligns with CWE-476, which describes a NULL pointer dereference where an application accesses memory at address zero without proper validation. In terms of adversarial tactics as defined by MITRE ATT&CK, this exploit technique falls under the category of Denial of Service (T1499), specifically endpoint denial of service through resource exhaustion or crash induction via malformed input. The attack vector is network-based and requires interaction with a potentially malicious RDP server, making it relevant in scenarios where users connect to untrusted or compromised remote desktop environments such as public kiosks, shared workstations, or hostile cloud infrastructure.
Mitigation strategies primarily involve upgrading the FreeRDP client software to version 3.32.0 or later, where this initialization sequence has been corrected to ensure that bitmap caches are fully initialized before any Cache Bitmap V3 orders are processed. For environments unable to upgrade immediately, administrators should consider disabling the non-default Bitmap Cache V3 feature by avoiding the use of the /cache:codec flag with RFX, NSC, or JPEG codecs until a patch is applied. Additionally, implementing network-level authentication and restricting connections to trusted Remote Desktop Protocol servers can reduce the risk profile associated with this vulnerability. Security teams should also monitor for unusual connection terminations in logs that may indicate attempted exploitation of this flaw within their infrastructure.