CVE-2026-121390 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2, specifically those compiled with Azure Active Directory authentication support enabled via the WITH_AAD flag, represents a critical failure in input validation within the Remote Desktop Protocol gateway communication layer. This flaw is classified as CWE-476, which denotes a NULL pointer dereference resulting from improper handling of null values during object access or function invocation. The root cause lies in the ARM gateway response parser, which fails to adequately verify the presence and data type of the redirectedServerCert field within incoming authentication responses. When this field is either missing entirely or present but not formatted as a valid string, the internal logic proceeds without raising an exception or returning an error code. Instead, it passes a null buffer pointer directly to the downstream certificate parsing routine, triggering an assertion failure that immediately terminates the client application process.
From an operational perspective, this vulnerability allows for a denial of service attack against FreeRDP clients connecting through gateways configured with Azure AD authentication. An attacker who controls or can manipulate the gateway server, such as by deploying a malicious proxy or compromising a legitimate gateway's response generation logic, can craft specific malformed responses that exploit this parsing defect. Upon receiving such a crafted packet, the client application will crash due to the unhandled null pointer dereference. This disruption prevents authorized users from establishing remote desktop sessions and can cause significant downtime in environments relying on FreeRDP for infrastructure access. The impact is particularly severe because it requires no user interaction beyond initiating or maintaining a connection through the compromised gateway, making it an effective vector for service interruption without requiring social engineering or complex exploitation techniques.
This issue aligns with MITRE ATT&CK technique T1499.002, Endpoint Denial of Service: Resource Exhaustion: Crash or Exit, as the primary outcome is the forced termination of a security-relevant process through resource exhaustion via invalid input handling. The vulnerability highlights the risks associated with trusting external inputs in authentication flows, particularly when dealing with complex protocol structures like those found in RDP gateway negotiations. Security researchers and developers emphasize that robust error checking must be implemented at every stage of data parsing to ensure that malformed or unexpected fields do not propagate null values into critical system functions.
To mitigate this vulnerability, organizations running FreeRDP should immediately upgrade to version 3.32.2 or later, where the issue has been resolved through enhanced validation logic for gateway response fields. For environments unable to patch immediately, network-level controls such as firewalls or intrusion prevention systems can be configured to inspect and block malformed RDP traffic containing suspiciously structured authentication responses. Additionally, administrators should ensure that all gateways involved in Azure AD authenticated sessions are strictly controlled and updated, minimizing the risk of exposure to malicious actors who might attempt to exploit this parsing flaw. Regular auditing of gateway configurations and monitoring for unexpected client disconnections can also aid in detecting potential exploitation attempts before they result in widespread service disruption.