{"id":"CVE-2026-121401","kind":"vulnerability","aliases":["CVE-2026-121401"],"related":[],"title":"FreeRDP: malicious RD Gateway packet crashes the client with a null dereference","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.","summary":"FreeRDP's RD Gateway code dispatches an extended-auth packet without checking the negotiated mode or auth context. A malicious or compromised RD Gateway can send that packet before tunnel authentication, causing a null-pointer dereference that crashes the client.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","package","rd-gateway","remote-desktop"],"not_affected_if":["fixed-version","no-rd-gateway"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version` or your package manager's version query.\n- Check whether connections go through an RD Gateway (the gateway setting in your remote desktop client configuration).","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-03T15:17:28+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","triaged_at":"2026-11-03T15:24:33+00:00","updated_at":"2026-11-03T15:24:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:24:33Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: malicious RD Gateway packet crashes the client with a null dereference","impact":"low","summary":"FreeRDP's RD Gateway code dispatches an extended-auth packet without checking the negotiated mode or auth context. A malicious or compromised RD Gateway can send that packet before tunnel authentication, causing a null-pointer dereference that crashes the client.","audience":"developers","category":"package","nicknames":[],"who_cares":["freerdp","remote-desktop","rd-gateway"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Client crashes when a hostile gateway sends the packet.","analyst_note":"","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version` or your package manager's version query.\n- Check whether connections go through an RD Gateway (the gateway setting in your remote desktop client configuration).","plain_action":"","needs_analyst":false,"not_affected_if":["no-rd-gateway","fixed-version"],"who_is_affected":"Only FreeRDP clients that connect through an RD Gateway are exposed, and the trigger is the gateway sending the packet, so the risk depends on trusting that gateway. Teams that connect directly without a gateway and teams already on 3.32.2 or later are not affected. The sources describe a denial of service (client crash), not code execution.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4199,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121401':15A,18A '-2026':14A,17A '3.32.2':71C 'auth':36B,44B,87C,94C,107C 'authent':58B,111C 'caus':59B 'check':39B 'client':8A,68B,121C 'code':31B 'compromis':49B,99C 'contain':72C 'context':45B,95C 'crash':6A,66B,119C 'cve':13A,16A 'denial':74C 'derefer':12A,64B,117C 'desktop':26B 'dispatch':32B,82C 'extend':35B,86C,106C 'extended-auth':34B,105C 'freerdp':1A,19B,27B,69C 'gateway':4A,23B,30B,51B,101C 'malici':2A,47B,97C 'mode':42B,92C 'msg':88C 'negoti':41B,91C 'null':11A,62B,115C 'null-point':61B,114C 'packag':20B 'packet':5A,37B,55B,81C,108C 'pkt':84C 'pointer':63B,116C 'process':80C 'rd':3A,22B,29B,50B,100C 'rd-gateway':21B 'rdg':79C 'remot':25B 'remote-desktop':24B 'send':53B,103C 'servic':76C 'trigger':112C 'tunnel':57B,110C 'type':85C 'verifi':90C 'vulner':77C 'without':38B,89C","nicknames":[],"mitigations":[],"who_affected":"Only FreeRDP clients that connect through an RD Gateway are exposed, and the trigger is the gateway sending the packet, so the risk depends on trusting that gateway. Teams that connect directly without a gateway and teams already on 3.32.2 or later are not affected. The sources describe a denial of service (client crash), not code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","medium","package","rdgateway","remotedesktop"],"first_public_at":"2026-10-19T12:29:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121401","severity":null,"published_at":"2026-11-03T15:17:28+00:00","modified_at":"2026-11-03T15:17:28+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","fetched_at":"2026-11-03T15:21:57+00:00","note":null}],"documents":[{"id":58325,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8rjm-m7xg-mg6m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:29:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58326,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-rd-gateway-extended-auth-packet","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}