Skip to main content

FreeRDP EUVDEUVD-2026-51819

| CVE-2026-67288 HIGH
NULL Pointer Dereference (CWE-476)
2026-08-01 VulnCheck GHSA-hq8h-rvcv-jvh4
Denial Of Service Null Pointer Dereference Freerdp
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable crash with no auth or user interaction; scope unchanged as only the client process terminates; pure availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:08 vuln.today
Analysis Generated
Aug 01, 2026 - 13:08 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

DescriptionCVE.org

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

AnalysisAI

Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.

Technical ContextAI

FreeRDP (cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) implements the Microsoft RDP protocol stack in open source and serves as the backend for numerous remote-desktop clients (e.g., Remmina, Guacamole, xfreerdp). The vulnerable code lives in the smartcard channel emulator, which decodes NDR-encoded smartcard I/O control requests forwarded from an RDP server to the client. NDR is the wire-encoding layer inherited from Microsoft's RPC/DCOM stack; it legally permits NULL pointers for optional fields. CWE-476 (NULL Pointer Dereference) applies: the decoders for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA accept a NULL NDR pointer for the LookupName field without validation, then unconditionally pass that pointer to strlen(), which dereferences address 0 and raises SIGSEGV, terminating the client process. The two referenced commits (f3b4347 and 5370fb2) address this and related path-handling issues; the diff provided for f3b4347 covers drive_file.c path-separator logic, while 5370fb2 (not shown) is the primary smartcard null-check fix.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which incorporates the fixes from commits f3b4347105114fe7453828736bea069999af320f and 5370fb26fbf034ecd11d3026b6ad639b5fff493f. The vendor advisory is at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3. Where immediate upgrade is not feasible, disable smartcard emulation on FreeRDP clients (typically via the /smartcard or /smartcard-channel flag or equivalent configuration); this removes the vulnerable code path entirely at the cost of losing smartcard-based authentication functionality during RDP sessions. Network-layer filtering between RDP servers and untrusted networks provides defence-in-depth but does not address sessions originating from a malicious or compromised RDP server.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-51819 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy