CVE-2026-121394 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within FreeRDP versions prior to 3.32.2 represents a critical stability issue rooted in the RemoteFX graphics decoding subsystem. Specifically, the flaw resides in the RLGR (Run-Length Golomb-Rice) decoder component responsible for processing compressed tilesets transmitted by remote desktop servers. This assertion failure allows an attacker who controls or manipulates an RDP server to cause a denial of service against the FreeRDP client application. The core technical issue arises when the decoder encounters specific malformed input data, particularly RLGR code values that exceed expected bounds during decompression operations.
The RemoteFX protocol is designed to optimize bandwidth usage by compressing graphical updates into tilesets before transmission over the network. When a server sends these compressed tiles, the client must decode them using algorithms such as RLGR to reconstruct the visual output for display. In this specific instance, an attacker can craft a malicious RDP session that includes a RemoteFX tileset containing an RLGR code value of 32767. This particular value triggers a signed narrowing assertion failure within the rfx_rlgr_decode function. An assertion is typically a debugging aid used to verify internal assumptions about data integrity; when such an assumption fails, the application terminates immediately rather than attempting to handle the error gracefully or continuing execution with potentially corrupted state.
From a technical perspective, this vulnerability aligns closely with CWE-617, which describes Reachable Assertion issues where code relies on conditions that may not hold true in production environments due to insufficient input validation. The failure occurs because the decoder does not adequately validate the range of incoming RLGR codes before processing them through logic paths that assume valid integer ranges suitable for signed narrowing operations. This lack of robust boundary checking allows out-of-bounds or unexpected values to propagate into critical decoding routines, leading directly to application termination.
The operational impact of this vulnerability is primarily a denial of service condition affecting end-users and potentially infrastructure relying on stable remote desktop sessions. Since the crash occurs at the client side, an attacker does not need local access or high privileges; they only require control over the RDP server endpoint being connected to by the victim. By sending the crafted packet containing the RLGR code 32767, the attacker can force any FreeRDP client running a vulnerable version to crash instantly. This disrupts productivity for users engaged in remote work and can be used as part of larger attack chains where stability is required for subsequent exploitation attempts or simply as an act of disruption against organizational IT resources.
Mitigation strategies focus on updating the software stack to eliminate the defective code path. Organizations utilizing FreeRDP must upgrade to version 3.32.2 or later, where this assertion failure has been addressed through improved input validation and error handling within the RLGR decoder logic. Until updates are applied, network-level controls such as firewalls can be configured to restrict RDP traffic to only known trusted servers, thereby reducing the attack surface available to malicious actors attempting to exploit this flaw via untrusted or compromised remote desktop endpoints.
This incident highlights the importance of rigorous input validation in protocol implementations, particularly for components handling complex compression algorithms like RemoteFX. The vulnerability maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it involves overwhelming or crashing a specific endpoint through malformed network traffic. Security teams should prioritize patching FreeRDP installations across all endpoints and monitor for any unusual disconnections from RDP sessions that may indicate attempted exploitation of this assertion failure.