Denial of Service Vulnerability in FreeRDP by FreeRDP
CVE-2026-121409

8.2HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121409?

FreeRDP versions prior to 3.32.2 are susceptible to a denial of service vulnerability that can be exploited by malicious servers or unauthenticated peers. This occurs when oversized X.224 routing tokens are sent in Server Redirection PDUs, leading to the abortion of client sessions or proxies. Specifically, attackers can manipulate the LoadBalanceInfo to send oversized tokens, triggering an assertion failure in the tpdu_write_header function and ultimately crashing the FreeRDP process.

Affected Version(s)

FreeRDP 0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32....
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
opensec-intelligence
.