CVE-2026-109241

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.0

Description A NULL pointer dereference occurs in the client video redirection channel. This issue allows a malicious server to cause a denial of service by sending out-of-order messages. Specifically, an attacker can send a Geometry CLEAR message to null the presentation->geometry variable, followed by a VideoData message that dereferences it, resulting in a client crash.

Recommendations Update to version 3.32.0 or later.