Live › vulnerability › CVE-2026-121394
FreeRDP from 3.11.0 before 3.32.2 has an assertion failure in its RemoteFX RLGR decoder. A malicious RDP server can send a crafted RemoteFX tileset that makes the client crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams whose users connect to RDP servers they do not fully trust, such as remote desktop clients used to reach third-party or public hosts. Exposure needs a malicious server to be on the other end of the connection; servers you run yourself are not the threat described.
No product ranges from the sources yet.
xfreerdp --version or the package manager, and compare against the fixed range.3.32.2 and later, per the NVD description (affected range 3.11.0 before 3.32.2).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121394")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.