FreeRDP EUVD-2026-115933

Exploitation requires the FreeRDP client user to connect to a malicious or compromised RD Gateway; the attacker does not reach the client directly. The gateway must send PKT_TYPE_EXTENDED_AUTH_MSG (type 0x0003) after the HTTP/WebSocket upgrade but before tunnel authentication completes. The default gateway configuration (GatewayHttpExtAuthSspiNtlm=FALSE) is vulnerable because this path frees the HTTP authentication context before tunnel packets arrive, leaving rdg->auth as NULL when rdg_process_packet dispatches the extended-auth packet. Enabling GatewayHttpExtAuthSspiNtlm=TRUE (extauth-sspi-ntlm mode) changes the code path and causes the trigger to fail negotiation without a crash, constituting a non-patch mitigation. The flaw affects the FreeRDP client process only; no server-side exploitation path exists. No special client configuration is required beyond the user initiating a gateway-mediated connection.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a pure client-side availability impact with no confidentiality or integrity effect. No CISA KEV listing is present in the input data, and no EPSS score was provided, so exploitation frequency cannot be quantified from the supplied signals. The decision label is 'this_month,' indicating a measured remediation priority rather than emergency response. A public PoC reference with complete C source code exists in GHSA-8rjm-m7xg-mg6m and the advisory describes verified crash reproduction (exit 134 assertion-enabled, exit 139 assertion-free), which lowers the skill bar for exploitation. However, the attack model requires the victim client to initiate a connection to a malicious or attacker-controlled RD Gateway - the attacker does not reach out to arbitrary clients. This server-controlled trigger substantially limits opportunistic or automated mass exploitation compared to a browser or listener vector. Default configurations (GatewayHttpExtAuthSspiNtlm=FALSE) are vulnerable; enabling extauth-sspi-ntlm changes the code path and prevents the crash, providing a non-patch mitigation. The impact ceiling is a crashed FreeRDP client process; no memory corruption or data access was demonstrated by the advisory. Overall this is a real but bounded risk: straightforward to exploit against clients that connect to attacker-controlled gateways, but not mass-exploitable without that gateway foothold.

An attacker who operates or has compromised an RD Gateway sends a 14-byte PKT_TYPE_EXTENDED_AUTH_MSG packet (type 0x0003) immediately after the HTTP/WebSocket upgrade, before tunnel authentication completes. Because rdg_process_packet does not verify the negotiated mode or rdg->auth context, a NULL pointer reaches credssp_auth_is_complete, crashing the FreeRDP client process. A public PoC reference with complete C source code is published in GHSA-8rjm-m7xg-mg6m; the advisory reports verified crash reproduction with exit codes 134 and 139 depending on build flags.