FreeRDP CVE-2026-110834

The victim's FreeRDP client (versions 2.0.0 up to but not including 3.32.0) must have serial-port device redirection enabled over the RDP serial channel on Linux - the vulnerable CommReadFile/CommWriteFile paths are only reached in that configuration. The user must also actively initiate a connection to an attacker-controlled or compromised RDP server (CVSS UI:P / passive interaction), which must then send an IRP_MJ_READ or IRP_MJ_WRITE before the channel's create or after its close. Limiting factors: serial redirection is a non-default, relatively uncommon deployment mode; the attack requires luring the victim to a malicious server rather than attacking a listening service; and impact is limited to a client crash with no code execution or data disclosure.

This is a client-side denial-of-service with no confidentiality or integrity impact (CVSS 4.0 VC:N/VI:N/VA:H), and should be triaged as a moderate, availability-only issue rather than a top priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-reachable, low-complexity, unauthenticated trigger, but UI:P means the victim must actively connect their FreeRDP client to an attacker-controlled or compromised RDP server - so this is a reverse/malicious-server attack, not a server-side remotely-attackable flaw. No EPSS score, KEV listing, or public exploit was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is no signal of active exploitation or widespread automated abuse. A key limiting factor not captured by the raw 7.1 score is that the crash only affects clients using Linux serial-port redirection, a non-default and relatively uncommon configuration, which substantially narrows the real-world attack surface below what AV:N/PR:N alone would suggest.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim running FreeRDP with Linux serial redirection enabled to connect to it. The server sends a serial IRP_MJ_READ or IRP_MJ_WRITE outside the normal create/close lifecycle, causing CommReadFile or CommWriteFile to dereference a null device handle and crash the client. No public exploit code was identified in the provided intelligence.