Is CVE-2026-109942 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109942?

CVE-2026-109942 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109942

Description

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.