CVE-2026-109252

FreeRDP versions 3.9.0 before 3.32.0 are vulnerable to a NULL pointer dereference within the RDPEAR NDR reader . A malicious server can trigger this by sending a CreateApReqAuthenticatorReq with a NameCount of two or more that ends before the Names pointer. This causes the cleanup process to dere...