CVE-2026-109253

A flaw was found in FreeRDP. When processing authentication data for Remote Credential Guard, the client checks data lengths before accounting for byte alignment padding. A malicious or compromised Remote Desktop Protocol (RDP) server can exploit this flaw by sending a crafted payload to a connected client. This triggers an out-of-bounds read and can crash the client process, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.