CVE-2026-109253 FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read
A malicious RDP server can crash FreeRDP clients using Remote Credential Guard by sending crafted unaligned RDPEAR payloads, causing an out-of-bounds read.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109253?
CVE-2026-109253 is a medium-severity memory corruption vulnerability in FreeRDP, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.
Weakness: CWE-125
Which versions are affected by CVE-2026-109253?
How do I fix CVE-2026-109253?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109253 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109253 exists.
Sources
Also known as DEBIAN-CVE-2026-109253, GHSA-6rj3-rf6g-3vw5, GHSA-wf28-64jf-4jwc, UBUNTU-CVE-2026-109253.