FreeRDP EUVD-2026-98701

Exploitation requires that the FreeRDP client (versions 3.0.0-beta4 up to but not including 3.32.0) be configured to connect through an ARM gateway, and that the attacker control that configured ARM endpoint - by operating it, having compromised it, or by performing a man-in-the-middle on the session - so as to return a zero-length HTTP 200 response body. It is therefore NOT exploitable against default/standalone RDP usage with no ARM gateway configured. Limiting factors: the victim must actively initiate a connection (passive user interaction, UI:P), the attacker must already sit in a trusted-gateway position rather than targeting arbitrary clients (attack requirement, AT:P), and the impact is confined to crashing the client (availability only) - there is no code execution, data disclosure, or server-side effect.

This is a client-side denial-of-service (CWE-476 NULL pointer dereference) with a genuinely moderate real-world risk that is correctly bounded by its CVSS 4.0 score of 6.0. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: network-reachable and requiring no privileges, but gated by an attack requirement (AT:P) and passive user interaction (UI:P), with impact limited to availability (VA:H) - no confidentiality or integrity loss and no scope change. The critical limiting factor, clear from the description, is that the attacker must control the ARM gateway the FreeRDP client is already configured to connect to; this is not a drive-by against arbitrary clients but against clients that trust a specific (now malicious or compromised/MITM'd) ARM endpoint. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent rather than conflicting: a network vector with low attack complexity but a meaningful precondition (attacker-controlled gateway) and availability-only impact. Bottom line - this is a real but low-priority issue for most defenders: patch it in the normal cycle, prioritize it only where FreeRDP clients are pointed at untrusted or externally influenceable ARM gateways.

An attacker who controls or has compromised the ARM gateway that a FreeRDP client is configured to use (or who can MITM that HTTPS session) returns an empty HTTP 200 response body when the client initiates a connection. The zero-length body is passed as a NULL pointer to strnlen inside arm_handle_request_ok, dereferencing NULL and crashing the client. No public exploit code was identified in the provided data; the crash is trivial to trigger once gateway control is held, but requires the victim to initiate a connection through the malicious gateway.