CVE-2026-121951 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP's server-side input parser skips a six-byte body on unknown slow-path input events without checking the packet length. A remote RDP client with an active session can send a truncated event to trigger a WinPR stream assertion and abort the server process.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only servers built with FreeRDP in the 3.0.0 to before 3.32.2 range that accept RDP sessions from remote clients are exposed. The sources say the crash needs assertion-enabled builds and an active session, so servers that do not run FreeRDP as an RDP server can skip it.
Not affected if client-only, default-release-build, no-rdp-server
Who cares freerdp, linux, rdp-server, windows
xfreerdp /version or your package manager, and compare against 3.32.2.3.0.0 before 3.32.2: move to 3.32.2.FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-121951") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.