FreeRDP CVE-2026-109241

Exploitation requires a victim to initiate an RDP session to an attacker-controlled or compromised server, with the client video redirection channel active/negotiated. The specific trigger is an out-of-order message sequence from the server: a Geometry CLEAR message that nulls presentation->geometry followed by a VideoData message that dereferences it. Limiting factors that reduce real-world risk: the attacker must control the server side (not exploitable against a victim who only runs a server or never connects outbound), user interaction is required to establish the connection (UI:P), impact is limited to crashing the client (no code execution, no data exposure), and only FreeRDP versions before 3.32.0 are affected.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L) and the 2.3 base score correctly reflect a client-side denial-of-service with no confidentiality or integrity impact and only LOW availability impact (a single client process crash, not a persistent or system-wide outage). The attack vector is 'network' but the real exploitation model is reversed from a typical server-side flaw: the attacker must operate or compromise the RDP server, and a victim must actively connect to it (UI:P / Passive user interaction, i.e. initiating a session), so this is not remotely triggerable against listening victims. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis, and the flaw is not in CISA KEV. The 'AT:P' (attack requirement present) reflects that the malicious server must send messages out of order (Geometry CLEAR before VideoData), though that sequencing is fully under a malicious server's control. Bottom line: a legitimate low-severity client crash bug, not an urgent patch priority outside environments where users routinely connect to untrusted RDP servers.

A user connects their FreeRDP-based client (e.g. a Linux RDP client) to an attacker-controlled or compromised RDP server that has the video redirection channel negotiated. The malicious server sends a Geometry CLEAR message that nulls presentation->geometry, then sends a VideoData message that dereferences the now-NULL pointer, crashing the client. No public exploit code was identified in the provided data; impact is limited to denial of service of the client session.