Denial of Service Vulnerability in FreeRDP by FreeRDP Development Team
CVE-2026-121389

2.3LOW

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121389?

FreeRDP versions prior to 3.32.2 are susceptible to a denial-of-service vulnerability within the handling of RDPDR device-list announcements. A malicious RDP server can exploit this weakness by sending malformed announcements that specify a DeviceDataLength greater than the packet's actual length. This flaw triggers a fatal assertion failure during device redirection, especially when TRACE logging and WinPR assertions are active, leading to client abortion. Remediation involves upgrading to the latest version to mitigate this risk and ensuring that proper security measures are in place.

Affected Version(s)

FreeRDP 3.27.0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.27.0-befor...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

opensec-intelligence
Kushalkhemka
mayank-jangid-moon
.