CVE-2026-23948 Details
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.
A NULL pointer dereference vulnerability has been identified in FreeRDP versions prior to 3.22.0. The issue arises in the 'rdp_write_logon_info_v2()' function, where a malicious RDP server can cause FreeRDP proxy to crash. This is achieved by sending a specially crafted LogonInfoV2 PDU with 'cbDomain=0' or 'cbUserName=0'. The vulnerability exists because the 'rdp_info_read_string()' function can return a NULL pointer without proper validation, leading to a crash when FreeRDP proxy attempts to process the information.
Users can upgrade to FreeRDP version 3.22.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.22.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 10, 2026 | Initial Analysis | [email protected] |
| Feb 9, 2026 | New CVE Received | [email protected] |