X11 Client Abort Vulnerability in FreeRDP by FreeRDP
CVE-2026-121411

2.3LOW

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121411?

FreeRDP versions prior to 3.32.2 experience a vulnerability where improper validation of server-supplied target dimensions and output origin within RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs can lead to potential exploitation. Malicious RDP servers can exploit this flaw, resulting in the unintended termination of X11 clients. Attackers may leverage this vulnerability to map surfaces to oversized scaled outputs, which triggers assertion failures and ultimately causes the client to abort unexpectedly.

Affected Version(s)

FreeRDP 0 < 3.32.2

FreeRDP 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32....
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
opensec-intelligence
.