CVE-2026-110829
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST.
Published Oct 14, 2026 · updated Oct 15, 2026
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
Oct 15, 2026 · OSV.dev
Fix available
freerdp3 fixed in 3.32.0+dfsg-1
Oct 15, 2026 · OSV.dev
Fix available
freerdp3 fixed in 3.32.0+dfsg-1
Oct 15, 2026 · OSV.dev
Updated
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
Oct 15, 2026 · NIST NVD
Updated
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.
Affected
- Debian:12 freerdp22.10.0+dfsg1-1, 2.10.0+dfsg1-1.1, 2.11.2+dfsg1-1
- Debian:13 freerdp33.15.0+dfsg-2.1, 3.15.0+dfsg-2.1+deb13u1, 3.15.0+dfsg-2.1+deb13u2
- Debian:14 freerdp30 → 3.32.0+dfsg-1
Sources
- CVE.orgVulnerability recordCVE-2026-110829
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-110829
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-110829
FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of
nvd.nist.gov - OSV.devPackage advisoryDEBIAN-CVE-2026-110829osv.dev