CVE-2026-110834 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP installations, particularly those using Linux serial redirection, should assess exposure and prioritize updates to version 3.32.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage FreeRDP deployments.

Why it matters

CVE-2026-110834 is a high-severity vulnerability in FreeRDP that allows malicious RDP servers to crash clients. Defenders should prioritize verifying and updating FreeRDP installations to version 3.32.0 or later, and assess exposure in Linux serial redirection contexts.

• Denial of Service (DoS) via client crashes
• Potential disruption to RDP services
• Need for verification of FreeRDP version and exposure
• Prioritization of updates to version 3.32.0 or later

Technical summary

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to dereference a null handle and terminate clients using Linux serial redirection. The vulnerability affects FreeRDP installations, particularly those using Linux serial redirection. Defenders should prioritize verifying and updating FreeRDP installations to version 3.32.0 or later.

Defensive priority

Defenders should prioritize verifying and updating FreeRDP installations to version 3.32.0 or later, and assess exposure in Linux serial redirection contexts.

Recommended defensive actions

• Verify and update FreeRDP installations to version 3.32.0 or later
• Assess exposure in Linux serial redirection contexts
• Monitor for suspicious RDP activity
• Implement compensating controls for serial IRP handling
• Review vendor guidance for affected FreeRDP deployments
• Conduct an inventory of assets using FreeRDP
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is described in the CVE Program record and NVD vulnerability detail page. FreeRDP's own security advisory and VulnCheck's advisory provide additional context. The CVE record was published on 2026-10-14T22:52:09.349Z and has not been modified since then. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify FreeRDP version and exposure in Linux serial redirection contexts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.