Executive brief
FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol. A security flaw in how it handles authentication redirection (Remote Credential Guard) allows a malicious or compromised server to corrupt the memory of a connecting user's computer. This could lead to the application crashing or potentially allow an attacker to gain unauthorized access to the user's system.
Technical details
A vulnerability exists in the RDPEAR NDR parser within FreeRDP's Remote Credential Guard implementation. The parser (specifically in `channels/rdpear/common/ndr.c`) fails to track the expected NDR type or ownership when a non-null NDR pointer reference ID (ref-id) is reused across multiple logical fields. This leads to aliasing where two different output fields point to the same heap object. During cleanup, the generic destructor attempts to free both fields independently, resulting in a double-free or use-after-free. Additionally, if the aliased fields are of different types and sizes (e.g., KERB_ASN1_DATA vs KERB_RPC_ENCRYPTION_KEY), it can result in type confusion and out-of-bounds reads. The vulnerability is reachable via the RDPEAR authentication-redirection path when connecting to a malicious server. Fixed in version 3.26.0.
Affected products
- FreeRDP FreeRDP < 3.26.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date