Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109253FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read
Medium 5.3
In plain English
A medium-severity out-of-bounds read in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-109253 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-109253 |
| Debian:14 | freerdp3 | 3.32.0+dfsg-1 | DEBIAN-CVE-2026-109253 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-109253 |
| Ubuntu:24.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-109253 |
| Ubuntu:26.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-109253 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-6rj3-rf6g-3vw5) vendor-advisory
- VulnCheck Advisory: FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read third-party-advisory