FreeRDP EUVD-2026-115934

Exploitation requires the xfreerdp client to connect to an attacker-controlled RDP server and for the RDPGFX graphics pipeline channel to be established via capability exchange. The malicious server must send an RDPGFX ResetGraphics PDU with width=0 (zero desktop width) followed by any normal bitmap update. The crash is confirmed on the X11 software GDI backend on Linux; other client backends and non-Linux platforms were not tested in the available evidence. The limiting factor is that the user must actively initiate or be redirected to a connection to the malicious server (CVSS UI:P). There is no exploitation path against a server or against clients that do not connect to the attacker's infrastructure. The session need not be authenticated to a domain - the attacker controls the server side, so PR:N applies to the attacker.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VA:H) scores 7.1, reflecting a network-reachable, low-complexity crash limited to the vulnerable client's availability - no confidentiality or integrity impact is present. The UI:P metric is the pivotal limiting factor: a user must actively connect xfreerdp to a malicious RDP server, precluding mass or opportunistic scanning-based exploitation. The decision label is 'this_week', consistent with the availability-only impact and interaction requirement. No CISA KEV listing exists; the GHSA advisory from the FreeRDP project contains a detailed callback-level C harness and records a live TLS/NLA test that produced SIGSEGV at gdi_Bitmap_Paint, confirming the crash is reproducible from a real network session. No attacker-controlled write, information disclosure, or code execution was shown - the demonstrated impact is exclusively client process termination. EPSS data is absent from the provided input. The primary realistic risk is denial of service against xfreerdp users who connect to untrusted servers (public kiosks, BYOD environments, penetration test targets connecting to rogue hosts). The lack of code execution and requirement for user-initiated connection substantially limits blast radius compared to a server-side RCE of equivalent CVSS score.

An attacker operates a malicious RDP server and persuades or redirects an xfreerdp user to connect to it. After TLS/NLA capability exchange and RDPGFX channel establishment, the server sends a ResetGraphics PDU with width=0, which nulls the client's primary GDI surface without terminating the session. The server then sends a normal bitmap update; gdi_Bitmap_Paint dereferences the NULL primary->hdc pointer and the client exits with SIGSEGV. A public PoC with demonstrated crash reproduction exists in the GHSA advisory, including a live TLS/NLA test result confirming exit code 139 at gdi_Bitmap_Paint.