CVE-2026-110834

Executive Summary

CVE-2026-110834 is a null pointer dereference vulnerability in FreeRDP affecting versions from 2.0.0 before 3.32.0, exploitable by malicious RDP servers that send out-of-lifecycle serial IRPs to connected clients. The flaw targets Linux serial redirection implementations, where functions CommReadFile or CommWriteFile dereference a null handle when processing IRP_MJ_READ or IRP_MJ_WRITE requests received before a create operation or after a close operation. Successful exploitation causes the FreeRDP client process to terminate, resulting in a denial of service condition with a CVSS score of 6.5. No patch, public proof-of-concept, or exploit code is currently available, and the vulnerability has not been added to CISA KEV.

Technical Analysis

The vulnerability resides in the serial redirection subsystem of FreeRDP, an open-source implementation of the Remote Desktop Protocol. FreeRDP clients on Linux that enable serial port redirection expose functionality allowing an RDP server to issue I/O request packets (IRPs) corresponding to serial device operations. Under normal protocol lifecycle, a serial device handle is established via a create operation, used for read and write operations, and released via a close operation.

CVE-2026-110834 manifests when a malicious or compromised RDP server sends an IRP_MJ_READ or IRP_MJ_WRITE request outside this expected lifecycle—specifically, before the corresponding create operation has occurred, or after a close operation has terminated the handle. In these cases, the functions CommReadFile and CommWriteFile are invoked with an invalid, null file handle. The functions fail to validate the handle state prior to dereferencing it, resulting in a null pointer dereference. This falls under CWE-476 (NULL Pointer Dereference), a memory-safety weakness class that leads to abnormal process termination rather than memory corruption or code execution.

The attack surface is the RDP serial channel, which is used to tunnel serial device traffic between client and server. Because serial redirection is a client-side feature that must be explicitly enabled or present in a session, the attack requires the victim to connect to a malicious server (typically via a crafted .rdp file or a compromised RDP endpoint) — hence the CVSS UI:R (User Interaction Required) component. The AV:N (Network) vector reflects that the malicious packets arrive over the network from the RDP server, and AC:L (Low Complexity) indicates no special conditions are needed beyond the client having serial redirection active.

Notably, the vulnerability was introduced in FreeRDP 2.0.0 and persists through 3.31.x; version 3.32.0 is the first release outside the affected range. There is no evidence of a vendor fix in any tracked source, and patch confidence is 0/4. The absence of a CNA title and detailed CVE metadata indicates that coordinated disclosure details remain sparse.

The impact is limited to availability (C:N/I:N/A:H): no confidentiality or integrity compromise occurs, because the flaw is a null dereference, not a memory corruption primitive. However, in environments where FreeRDP clients are used for critical administrative access, terminating the client mid-session can disrupt operations, and repeated triggering can cause persistent denial of service against users reliant on serial-connected infrastructure.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-110834; the attack chain described below is inferred from the vulnerability class and the NVD-provided description.

1. Reconnaissance / target identification: An attacker positions a malicious RDP server or compromises a legitimate RDP endpoint that targets FreeRDP clients on Linux. The attacker must ensure the victim connects with serial redirection enabled. This can be achieved through social engineering (delivering an .rdp configuration file that enables serial redirection) or by targeting users who routinely connect to endpoints exposing serial channels.

2. Triggering the flaw class: Once the victim establishes an RDP session, the malicious server sends serial IRP traffic out of the expected lifecycle. Specifically, it transmits an IRP_MJ_READ or IRP_MJ_WRITE request either before any create operation has established the serial handle, or after a close operation has already released it. This violates the protocol's state machine assumptions.

3. Payload / execution at the vulnerability class level: The out-of-lifecycle IRP reaches the FreeRDP client's serial redirection handling path, where CommReadFile or CommWriteFile is invoked. With no valid handle present, the functions dereference a null pointer. No payload beyond the malformed IRP sequence is required; the vulnerability class is a straightforward null pointer dereference, not an injection or corruption attack.

4. Post-exploitation impact: The null pointer dereference causes the FreeRDP client process to crash and terminate, disconnecting the user's session. The attacker can repeat the sequence to maintain a persistent denial of service against the victim. Because the flaw does not permit code execution or memory disclosure, the impact is confined to availability loss for the client.

The attack requires user interaction to initiate the RDP connection, and exploitation does not require authentication or special privileges on the client side (PR:N). No public exploit tooling, Nuclei template, or exploit code has been observed.

Impact Assessment

Business impact is primarily availability-oriented. Organizations using FreeRDP clients on Linux for administrative or operational access to serial-connected systems (industrial control, network appliances, or legacy infrastructure) may experience session termination and workflow disruption. The CVSS score of 6.5 (Medium) reflects a network-reachable, low-complexity attack that requires user interaction and causes high availability impact without confidentiality or integrity loss.

Affected systems are FreeRDP clients running versions 2.0.0 through 3.31.x with serial redirection enabled. The blast radius is limited to individual client processes — there is no server-side or lateral movement potential from this flaw alone. However, in environments where a single malicious RDP server is used to target many clients, the attacker can cause repeated denial of service across an affected user population.

Because no patch exists and no workaround is documented, unmitigated exposure remains until FreeRDP 3.32.0 or later is broadly deployed. The EPSS score has not been assigned by FIRST.org, and the vulnerability has not been added to CISA KEV; there is no evidence of active exploitation in the wild.

Detection Guidance

Sigma Rule

title: FreeRDP Serial IRP Out-of-Lifecycle Null Pointer Dereference Attempt
id: 8f3c2a1e-4b7d-4e9a-9c1f-2d6e5a8b0c3f
status: experimental
description: Detects FreeRDP client process termination following serial redirection activity consistent with CVE-2026-110834
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110834
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1499
  - attack.impact
logsource:
  product: linux
  service: syslog
detection:
  selection_process:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/freerdp'
  selection_crash:
    message|contains:
      - 'CommReadFile'
      - 'CommWriteFile'
      - 'null pointer'
      - 'SIGSEGV'
      - 'segfault'
  condition: selection_process and selection_crash
falsepositives:
  - Legitimate serial redirection driver errors unrelated to malicious IRP sequences
level: medium

YARA Rule

rule CVE_2026_110834_FreeRDP_Serial_IRP_NullDeref
{
    meta:
        description = "Detects FreeRDP binaries containing serial redirection symbols associated with CVE-2026-110834"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110834"
        cve = "CVE-2026-110834"
    strings:
        $s1 = "CommReadFile" ascii
        $s2 = "CommWriteFile" ascii
        $s3 = "IRP_MJ_READ" ascii
        $s4 = "IRP_MJ_WRITE" ascii
        $s5 = "serial" ascii nocase
    condition:
        uint16(0) == 0x457f and
        filesize < 50MB and
        (2 of ($s1, $s2, $s3, $s4) or ($s5 and 1 of ($s1, $s2)))
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-110834 FreeRDP Serial IRP Out-of-Lifecycle Attempt"; flow:established,to_client; content:"|03 00|"; depth:2; content:"|00 00 00 00|"; within:200; classtype:attempted-dos; reference:cve,2026-110834; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110834; sid:2026110834; rev:1;)

Elastic Detection

process where event.type == "end" and
process.name in ("xfreerdp", "wlfreerdp", "freerdp") and
process.exit_code != 0 and
process.command_line like~ "*serial*"

Splunk SPL Query

index=linux sourcetype=syslog (xref OR wlfreerdp OR freerdp)
| search "CommReadFile" OR "CommWriteFile" OR "null pointer" OR "segfault" OR "SIGSEGV"
| stats count values(message) as messages by host, process_name
| where count > 0

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-110834,">
  <rule id="2026110834" level="10">
    <decoded_as>syslog</decoded_as>
    <match>CommReadFile|CommWriteFile|IRP_MJ_READ|IRP_MJ_WRITE</match>
    <description>CVE-2026-110834: FreeRDP serial IRP out-of-lifecycle null pointer dereference detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="2026110835" level="8">
    <if_sid>2026110834</if_sid>
    <match>segfault|SIGSEGV|null pointer</match>
    <description>CVE-2026-110834: FreeRDP client crash following serial IRP anomaly</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable serial redirection (/serial or equivalent) in FreeRDP client configurations where not operationally required. This removes the attack surface entirely.
   • Restrict outbound RDP connections to trusted, known-good servers using network egress filtering or application allowlisting.
   • Educate users not to open unsolicited .rdp configuration files from untrusted sources.
   • Monitor for repeated FreeRDP client crashes among users as a potential indicator of active attack attempts.

2. Patch/upgrade steps:

   • Upgrade to FreeRDP 3.32.0 or later, which is outside the affected version range. No vendor-specific patch has been published; the fix is assumed to be bundled in the 3.32.0 release.
   • Track the FreeRDP project repository and mailing lists for formal CVE resolution and any backports to 2.x branches.

3. Long-term hardening:

   • Enforce the principle of least functionality by disabling unused RDP channels (serial, drive, clipboard, printer) by default in enterprise client baselines.
   • Deploy endpoint detection to monitor client process termination and correlate with session metadata.
   • Maintain a vulnerability management process that tracks CVEs affecting FreeRDP, given its role in remote access and its history of memory-safety issues.

References

1. NVD — CVE-2026-110834: https://nvd.nist.gov/vuln/detail/CVE-2026-110834
2. FreeRDP Project: https://www.freerdp.com/
3. FreeRDP GitHub Repository: https://github.com/FreeRDP/FreeRDP
4. CWE-476 — NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry for this CVE as of report date)

No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept code have been identified for CVE-2026-110834.