{"id":"CVE-2026-121960","kind":"vulnerability","aliases":["CVE-2026-121960"],"related":[],"title":"FreeRDP: crafted CredSSP request crashes the NLA shadow server","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process.","summary":"FreeRDP's NLA-enabled shadow server aborts when a CredSSP TSRequest omits the negoTokens field. An unauthenticated attacker can send a seven-byte request and stop the server process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","package","remote-desktop","self-hosted"],"not_affected_if":["nla-disabled","no-shadow-server"],"how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or the package manager.\n- Look for a running FreeRDP shadow server (`wlfreerdp-shadow` or `freerdp-shadow-cli`) with NLA enabled.","fix":"- Move FreeRDP to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","triaged_at":"2026-11-04T16:28:37+00:00","updated_at":"2026-11-04T16:28:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:28:37Z","model":"claude-haiku-5-5","output":{"fix":"- Move FreeRDP to `3.32.2` or later.","reach":"network","title":"FreeRDP: crafted CredSSP request crashes the NLA shadow server","impact":"low","summary":"FreeRDP's NLA-enabled shadow server aborts when a CredSSP TSRequest omits the negoTokens field. An unauthenticated attacker can send a seven-byte request and stop the server process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","self-hosted","remote-desktop"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker crashes the shadow server process repeatedly","analyst_note":"","how_to_check":"- Check the installed FreeRDP version with `xfreerdp --version` or the package manager.\n- Look for a running FreeRDP shadow server (`wlfreerdp-shadow` or `freerdp-shadow-cli`) with NLA enabled.","plain_action":"","needs_analyst":false,"not_affected_if":["no-shadow-server","nla-disabled"],"who_is_affected":"Only systems running a FreeRDP shadow server with NLA enabled are exposed, because the crash happens during CredSSP authentication setup. Desktop clients and servers that do not run the shadow server are not described as affected. unknown whether other FreeRDP server modes share the same code path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4189,"output_tokens":526,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121960':12A,15A '-2026':11A,14A '3.32.2':57C 'abort':31B,99C 'assert':97C 'attack':42B,78C 'byte':48B,85C 'contain':58C,87C 'craft':2A,82C 'crash':5A 'credssp':3A,34B,73C 'cve':10A,13A 'denial':60C 'desktop':20B 'enabl':28B,68C 'fatal':95C 'field':39B,91C 'freerdp':1A,16B,24B,55C 'host':23B 'negotoken':38B,76C 'nla':7A,27B,67C 'nla-en':26B,66C 'omit':36B,75C 'packag':17B 'process':54B,102C 'remot':19B 'remote-desktop':18B 'request':4A,49B 'self':22B 'self-host':21B 'send':44B,80C 'server':9A,30B,53B,70C,101C 'servic':62C 'seven':47B,84C 'seven-byt':46B,83C 'shadow':8A,29B,69C 'stop':51B 'trigger':93C 'tsrequest':35B,74C,86C 'unauthent':41B,77C 'version':90C 'vulner':63C 'winpr':96C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a FreeRDP shadow server with NLA enabled are exposed, because the crash happens during CredSSP authentication setup. Desktop clients and servers that do not run the shadow server are not described as affected. unknown whether other FreeRDP server modes share the same code path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","package","remotedesktop","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-20T17:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121960","severity":null,"published_at":"2026-11-04T16:17:48+00:00","modified_at":"2026-11-04T16:17:49+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","fetched_at":"2026-11-04T16:28:14+00:00","note":null}],"documents":[{"id":68493,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3pg4-5r42-wxvj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:18:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68494,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-unauthenticated-denial-of-service-via-credssp-tsrequest","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}