Description
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
Published: 2026-10-13
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A NULL pointer dereference is triggered when FreeRDP processes an RD Gateway CLOSE_CHANNEL packet that contains only an 8-byte header and no payload. When the client receives this malformed packet the runtime dereferences a null stream, causing the client to crash. The result is a loss of service for users connecting through that RD Gateway, but there is no direct code‑execution or information‑disclosure vector reported.

Affected Systems

FreeRDP version 2.3.0 through 3.31.3. Customers running any of these releases that connect through an RD Gateway are vulnerable. The issue exists in the core gateway processing code, rdg_process_close_packet in libfreerdp/core/gateway/rdg.c.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. EPSS data is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. It requires an attacker to control or compromise the RD Gateway to send the crafted CLOSE_CHANNEL packet, which is an external attack vector.

Generated by OpenCVE AI on October 13, 2026 at 14:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or later to apply the vendor‑supplied fix.
  • Configure any RD Gateway servers to reject or ignore malformed CLOSE_CHANNEL packets pending a client update.
  • Apply additional network‑level monitoring to detect abnormal RD Gateway traffic and alert on crashes.

Generated by OpenCVE AI on October 13, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
Title FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-476
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T13:27:11.301Z

Reserved: 2026-10-13T11:24:25.841Z

Link: CVE-2026-109942

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T14:17:32.220

Modified: 2026-10-13T14:17:32.220

Link: CVE-2026-109942

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:15:14Z

Weaknesses