Log in Start free

Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-23948FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

Medium 6.9

In plain English

A medium-severity null pointer dereference in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-devel2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp-devel2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp-devel2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-libs2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8freerdp-libs2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9freerdp-libs2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10freerdp-server2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:10libwinpr2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8libwinpr2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9libwinpr2:2.11.7-1.el9_7.5ALSA-2026:6340
AlmaLinux:10libwinpr-devel2:3.10.3-5.el10_1.5ALSA-2026:6799
AlmaLinux:8libwinpr-devel2:2.11.7-6.el8_10ALSA-2026:6918
AlmaLinux:9libwinpr-devel2:2.11.7-1.el9_7.5ALSA-2026:6340
Alpine:v3.23freerdp3.22.0-r0ALPINE-CVE-2026-23948
Alpine:v3.24freerdp3.22.0-r0ALPINE-CVE-2026-23948
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-23948
Debian:13freerdp33.15.0+dfsg-2.1+deb13u1DEBIAN-CVE-2026-23948
Debian:14freerdp33.22.0+dfsg-1DEBIAN-CVE-2026-23948
Rocky Linux:10freerdp2:3.10.3-5.el10_1.5RLSA-2026:6799
Rocky Linux:8freerdp2:2.11.7-6.el8_10RLSA-2026:6918
Rocky Linux:9freerdp2:2.11.7-1.el9_7.5RLSA-2026:6340
Ubuntu:22.04:LTSfreerdp22.6.1+dfsg1-3ubuntu2.10USN-8042-1
Ubuntu:22.04:LTSfreerdp22.6.1+dfsg1-3ubuntu2.10UBUNTU-CVE-2026-23948
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.2USN-8042-1
Ubuntu:24.04:LTSfreerdp33.5.1+dfsg1-0ubuntu1.2UBUNTU-CVE-2026-23948
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.1USN-8042-1
Ubuntu:25.10freerdp33.16.0+dfsg-2ubuntu0.1UBUNTU-CVE-2026-23948

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP < 3.22.0

Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References