FreeRDP EUVD-2026-97696

Exploitation requires the victim's FreeRDP client (versions 3.9.0 through 3.31.x) to initiate an RDP connection to a server the attacker controls or has compromised, and that session must reach the RDPEAR (Kerberos remote credential) NDR exchange - specifically the client must process a CreateApReqAuthenticatorReq message. The concrete trigger is a KERB_RPC_INTERNAL_NAME structure with NameCount of two or more whose buffer is truncated before the Names pointer, causing the NDR reader's cleanup path to dereference a null base. Limiting factors that reduce real-world risk: the attack is client-side and reversed (the victim must be lured into connecting to a malicious/untrusted server rather than the attacker reaching the client directly), user interaction is required to establish the session (UI:P), and the impact is limited to crashing the client with no confidentiality or integrity consequence. Clients that only connect to trusted internal RDP servers are at substantially lower risk.

This is a client-side denial-of-service (NULL pointer dereference, CWE-476) with a moderate CVSS 4.0 base score of 6.0. The vendor-supplied 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: although the attack vector is network-based, exploitation is gated by high attack complexity (AC:H), a present attack requirement (AT:P), and required user interaction (UI:P) - the victim must be induced to connect their FreeRDP client to an attacker-controlled or compromised RDP server. Impact is confined to availability (VA:H, client crash/termination) with zero confidentiality or integrity impact and no scope change to other systems, so this cannot lead to code execution or data loss on the evidence provided. On the real-world-risk signals: there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS probability was supplied - absence of these is not itself evidence of safety but means there is no indication of active or widespread exploitation. Net assessment: a genuine but lower-priority issue. It is not a high-CVSS-but-illusory risk (the crash is real and remotely triggerable), yet the reversed direction of attack (client must initiate the connection to a malicious server) and availability-only impact place it well below network-facing unauthenticated RCE or server-side DoS flaws. Patch on a normal cadence; prioritize hosts that routinely connect to untrusted or externally-hosted RDP endpoints.

An attacker stands up or compromises an RDP server and lures a victim to connect with a vulnerable FreeRDP client (3.9.0 up to but not including 3.32.0). During the RDPEAR Kerberos exchange the malicious server returns a CreateApReqAuthenticatorReq whose KERB_RPC_INTERNAL_NAME is truncated - NameCount is two or more but the buffer ends before the Names pointer - so cleanup dereferences a null base and terminates the client. No public exploit code was identified at time of analysis, and the attack yields only a crash, not control of the client.