Executive brief
FreeRDP is a remote desktop protocol (RDP) client used to connect to Windows and other systems. A malicious RDP server can crash a FreeRDP client by sending a specially crafted network message, causing a denial of service. This attack requires no authentication—any user who connects to an attacker-controlled server is vulnerable, making it a practical threat to client deployments.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the gdi_surface_bits function within libfreerdp/gdi/gdi.c. When processing RDP Surface Bits commands, the code attempts to use an NSCodec decoder without verifying it exists; the decoder is only allocated if the user explicitly enables NSCodec via command-line flag (disabled by default). A malicious server can send a Surface Bits command claiming to use NSCodec codec ID (0x01), causing the null pointer to be passed to nsc_process_message, which crashes without validation. The attack vector is network-based with no authentication required; a user only needs to connect to a malicious RDP server. The crash occurs before any bitmap data is processed (message size is 22 bytes). FreeRDP versions 3.30.0 and earlier are affected; the fix is available in version 3.31.0.
Affected products
- FreeRDP FreeRDP < 3.31.0
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 3.31.0