Live › vulnerability › CVE-2026-121389
FreeRDP, a remote desktop client library, crashes when a malicious RDP server sends a malformed device-list announcement with a declared length larger than the packet. An attacker gets a denial of service that aborts the client, with no code execution stated in the sources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Only clients connecting to RDP servers the team does not trust can be aborted, since the malicious packet must come from a server. The sources say the crash needs device redirection enabled and a debug-style build with TRACE logging and WinPR assertions on, so default builds are less exposed. Teams that only connect to their own trusted RDP hosts can deprioritise it.
No product ranges from the sources yet.
xfreerdp --version or the package manager's version for freerdp3.32.2 or later, the first fixed version stated by the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-121389")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.