CVE-2026-121960 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP's NLA-enabled shadow server aborts when a CredSSP TSRequest omits the negoTokens field. An unauthenticated attacker can send a seven-byte request and stop the server process.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only systems running a FreeRDP shadow server with NLA enabled are exposed, because the crash happens during CredSSP authentication setup. Desktop clients and servers that do not run the shadow server are not described as affected. unknown whether other FreeRDP server modes share the same code path.
Not affected if nla-disabled, no-shadow-server
Who cares freerdp, remote-desktop, self-hosted
xfreerdp --version or the package manager.wlfreerdp-shadow or freerdp-shadow-cli) with NLA enabled.3.32.2 or later.FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121960") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.