CVE-2026-121389 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical denial of service flaw located within the rdpdr_dump_packet function. This component is responsible for processing Remote Desktop Protocol Device Redirection (RDPDR) packets, which facilitate the mapping of local devices such as printers, drives, and serial ports to remote sessions. The specific weakness arises when handling malformed device-list announcements sent by a malicious RDP server. In this scenario, an attacker can craft a packet where the declared DeviceDataLength field exceeds the actual length of data received in the payload. This discrepancy triggers a fatal assertion failure within the Stream_Seek function, provided that device redirection is enabled, TRACE logging is active, and WinPR assertions are not disabled. The result is an immediate termination or crash of the FreeRDP client process, effectively denying service to legitimate users attempting to establish or maintain remote desktop connections.
From a technical perspective, this flaw stems from insufficient validation of input data lengths before performing stream operations. When the application attempts to seek within the packet buffer based on the untrusted DeviceDataLength value provided by the server, it encounters an invalid memory offset because the requested length surpasses the available buffer size. This leads to a runtime assertion failure rather than a graceful error handling routine or bounds check that would prevent out-of-bounds access. The vulnerability is particularly exploitable in environments where verbose logging and debugging features are enabled for troubleshooting purposes, as these settings often leave assertions active during production operations. Consequently, any RDP client configured with these diagnostic tools becomes susceptible to remote denial of service attacks initiated by compromised or malicious servers advertising device redirection capabilities.
The operational impact of this vulnerability is significant for organizations relying on FreeRDP for secure remote access infrastructure. A successful exploitation results in the abrupt termination of the client application, disrupting ongoing work and potentially causing data loss if unsaved documents are involved. Furthermore, repeated crashes can degrade user trust in the reliability of the remote desktop solution. Since RDPDR is a common feature used to enhance productivity by allowing seamless integration of local peripherals with remote environments, attackers targeting this vector can effectively neutralize access for multiple users simultaneously if they control or compromise an RDP server within the network perimeter. This aligns with the ATT&CK technique T1499 Endpoint Denial of Service, where adversaries aim to exhaust resources or crash services to hinder operational continuity.
To mitigate this risk, organizations should immediately upgrade FreeRDP to version 3.32.2 or later, which includes patches for improper input validation in the RDPDR packet processing logic. In cases where upgrading is not immediately feasible, administrators can reduce the attack surface by disabling TRACE logging and ensuring that WinPR assertions are disabled in production builds through appropriate build configuration flags. Additionally, network segmentation strategies should be employed to restrict access to FreeRDP clients from untrusted or public-facing RDP servers until patches are applied. Monitoring logs for assertion failures or unexpected client terminations can also aid in detecting potential exploitation attempts. This vulnerability is categorized under CWE-20 Improper Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions, highlighting the necessity of robust boundary checks when processing external data streams in network protocol implementations.