RemoteFX Decoder Vulnerability in FreeRDP Software by FreeRDP
CVE-2026-121395

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121395?

FreeRDP versions 3.17.0 to 3.32.1 are susceptible to a denial of service due to an assertion failure in the RemoteFX differential decoder. An attacker can exploit this vulnerability by sending a malicious RDP server that delivers a crafted RemoteFX tile, which results in the client process being aborted when verbose WinPR assertions are enabled. This poses a significant risk as it can lead to unexpected termination of the FreeRDP client during remote desktop sessions.

Affected Version(s)

FreeRDP 3.17.0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.17.0-befor...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

opensec-intelligence
Kushalkhemka
mayank-jangid-moon
.