CVE-2026-110834 in FreeRDP
Summary
by MITRE • 10/15/2026
FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in FreeRDP versions ranging from 2.0.0 up to but not including 3.32.0 represents a critical security flaw within the Remote Desktop Protocol client implementation, specifically affecting the handling of serial device redirection features on Linux systems. This null pointer dereception issue arises due to insufficient validation of the lifecycle state of Input/Output Request Packets, commonly referred to as IRPs, when interacting with virtualized serial ports. The core technical deficiency lies in the failure of the application to verify whether a communication channel has been properly initialized or has already been terminated before processing read and write operations. Consequently, an attacker operating a malicious RDP server can exploit this logic error by transmitting specific control packets that bypass standard state checks, leading directly to memory corruption events within the client process.
From a technical perspective, the flaw manifests when the client receives IRP_MJ_READ or IRP_MJ_WRITE requests outside of their valid operational lifecycle. Specifically, these malicious operations are executed either before the serial port has been created via an initialization sequence or after it has already been closed by the user session. In both scenarios, the underlying functions CommReadFile and CommWriteFile attempt to access a handle that is null because no active connection exists for those specific phases of communication. This dereference of a null pointer triggers an immediate segmentation fault, causing the FreeRDP client application to crash abruptly. The vulnerability leverages the asynchronous nature of network communications in RDP sessions, allowing remote code execution contexts or simply denial-of-service conditions without requiring any prior authentication if the server is configured to allow unauthenticated connections, although typically it requires a valid session context to send such crafted packets effectively.
The operational impact of this vulnerability is primarily characterized by a Denial of Service against end-users relying on FreeRDP for remote access with serial device redirection enabled. By forcing the client application to terminate unexpectedly, attackers can disrupt critical workflows that depend on stable remote desktop sessions, particularly in environments where industrial control systems or legacy hardware interfaces are accessed through RDP tunnels using virtual COM ports. While the immediate effect is a crash rather than arbitrary code execution, such instability undermines trust in the security posture of remote access infrastructure and can be used as part of broader attack chains to exhaust system resources or mask other malicious activities during periods of user disruption.
This vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where a program dereferences a pointer that it expects to point to valid memory but does not. In the context of MITRE ATT&CK, this behavior corresponds to techniques related to Impact and potentially Defense Evasion through service disruption, specifically falling under T1529 System Shutdown or Reboot if the crash leads to automatic restarts in managed environments, though primarily it is classified as a resource exhaustion vector within the broader scope of application layer attacks. The lack of proper state machine validation for I/O operations highlights a common pattern in legacy protocol implementations where lifecycle management was not rigorously enforced against adversarial inputs designed to exploit race conditions or logical gaps.
To mitigate this risk, organizations utilizing FreeRDP must ensure that all client instances are updated to version 3.32.0 or later, which includes the necessary patches for validating IRP states before processing read and write commands. Administrators should also consider implementing network-level authentication requirements where possible to restrict access to RDP servers, thereby reducing the attack surface available to potential adversaries attempting to exploit this flaw. Additionally, deploying intrusion detection systems capable of identifying anomalous patterns in serial redirection traffic can provide an additional layer of defense against such crafted packets until all endpoints are fully patched. Regular security audits focusing on protocol implementation robustness and adherence to strict state machine enforcement will further reduce the likelihood of similar vulnerabilities emerging in future updates or related software components.