Live › vulnerability › CVE-2026-121406
FreeRDP's RDPGFX channel handler does not check for a null output from ZGFX decompression, so a zero-output payload triggers an assertion abort. A malicious RDP server can use this to terminate the connected FreeRDP client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Anyone running a FreeRDP client older than 3.32.2 that connects to RDP servers, especially servers outside their control. Exposure needs an established session, since the payload is sent on the RDPGFX channel after session activation. Teams that only run FreeRDP against trusted servers face a lower risk.
No product ranges from the sources yet.
xfreerdp --version or the package manager, and compare against the fixed version in the Fix section.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121406")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.