FreeRDP CVE-2026-109939

Exploitation requires the FreeRDP client to have the non-default Bitmap Cache V3 feature explicitly enabled via /cache:codec:<rfx|nsc|jpeg>; clients using default settings are not affected. The victim must actively initiate an RDP connection (UI:P) to an attacker-controlled or compromised server, and the malicious Cache Bitmap V3 order with the CBR3_DO_NOT_CACHE flag must be delivered during connection setup before the Demand Active phase. Limiting factors: default configurations are not vulnerable, the attack requires the user to connect to a hostile server rather than the reverse, and impact is limited to a client crash (availability only).

This is a client-side denial-of-service with no confidentiality or integrity impact (CVSS 4.0 VC:N/VI:N/VA:H; CWE-476 NULL pointer dereference). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-reachable, low-complexity bug requiring passive user interaction - consistent with the description, since the victim is a FreeRDP client that must initiate a connection to a malicious or compromised RDP server. No EPSS score, KEV listing, or POC reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is materially constrained by two factors the raw 7.1 score does not fully convey: (1) the vulnerable code path is only reachable when the non-default Bitmap Cache V3 feature is explicitly enabled (/cache:codec:<rfx|nsc|jpeg>), and (2) the impact ceiling is a client crash, not code execution or data exposure. This is a lower-priority issue than its HIGH severity suggests - a reliability/availability bug affecting a minority of specifically-configured clients, not a widespread remotely-exploitable server compromise. Note the attack direction is inverted from the typical RDP threat model: here a rogue server attacks clients, so exposure depends on users connecting to attacker-controlled or compromised RDP endpoints.

A user running a FreeRDP-based client with the non-default Bitmap Cache V3 codec enabled connects to a malicious or previously compromised RDP server. During connection setup (before Demand Active), the server sends a crafted Cache Bitmap V3 order with the CBR3_DO_NOT_CACHE flag set, causing the client to dereference the uninitialized bitmap cache and crash. No public exploit code is identified in the provided data; exploitation requires the victim to initiate the connection (UI:P).