GHSA-x7v7-9jp5-wqj2

FreeRDP: Client Video redirection channel NULL dereference

FreeRDP

Open in Threatline Record JSON

CVSS

4.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in3.32.0Fixed versionGitHub

Published28 Sep 2026Updated 28 Sep 2026GitHub

What fixes it

3.32.0FreeRDP, cGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Clients crash with a NULL dereference if a server sends messages in wrong order.

Details

Geometry CREATE
      |
      v
presentation->geometry = valid object
      |
      v
Geometry CLEAR
      |
      v
mappedGeometryUnref(...)
      |
      v
presentation->geometry = nullptr
      |
      v
subsequent VideoData processing
      |
      v
geom = presentation->geometry
      |
      v
frame / presentation processing
      |
      v
potential NULL dereference

Patches

3.32.0

Workarounds

Do not use /video client option

Text from GitHub Advisory Database

Affected versions 1

FreeRDP, c<= 3.31.1GitHub