Live › vulnerability › CVE-2026-121410
FreeRDP before 3.32.2 does not validate zero width and height in the RDPGFX WIRETOSURFACE_2 handler. A malicious RDP server can send a crafted PDU that triggers an assertion or division by zero and terminates the client session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running FreeRDP clients that connect to RDP servers they do not fully trust. The flaw is triggered by a malicious server sending a crafted graphics PDU, so the risk is a denial of service on the client session, not code execution or data theft. Clients that only connect to trusted internal servers are lower risk.
No product ranges from the sources yet.
xfreerdp --version) and see whether it is below 3.32.2.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.
This page as .md · .json · in your agent: get_signal("CVE-2026-121410")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.