CVE-2026-109942 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP clients and RD Gateway infrastructure should assess exposure and prioritize patching or mitigation. This includes IT teams managing FreeRDP deployments, security teams monitoring for potential crashes, and operators of RD Gateway services. Ensuring that FreeRDP clients are updated to version 3.32.0 or later is crucial, along with implementing network-based mitigations to detect and block malicious RD Gateway packets. Proак

Why it matters

Defenders should care about CVE-2026-109942 because it can cause crashes of FreeRDP clients. FreeRDP clients and RD Gateway infrastructure defenders should assess exposure, prioritize patching or mitigation, monitor client logs, and verify client versions.

• Potential crashes of FreeRDP clients
• Need for patching or mitigation to prevent crashes
• Monitoring of FreeRDP client logs for crash events
• Verification of FreeRDP client versions and exposure

Technical summary

The vulnerability exists in the rdg_process_close_packet function in libfreerdp/core/gateway/rdg.c. A malicious RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client. This occurs because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. The issue is specific to FreeRDP 2.3.0 before 3.32.0, and defenders should focus on updating to version 3.32.0 or later as a primary mitigation strategy. The vulnerability highlights the importance of validating packet payloads to prevent NULL pointer dereferences.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential crashes of FreeRDP clients.

Recommended defensive actions

• Patch FreeRDP to version 3.32.0 or later
• Implement network-based mitigations to detect and block malicious RD Gateway packets
• Monitor FreeRDP client logs for crash events
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a NULL pointer dereference in the rdg_process_close_packet function in libfreerdp/core/gateway/rdg.c. This occurs because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.