CVE-2026-121406 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical logic error within the Remote Desktop Graphics (RDPGFX) subsystem, specifically affecting the handling of compressed graphical data streams. This flaw stems from an insufficient validation mechanism during the decompression process managed by the rdpgfx_on_data_received function. When processing incoming ZGFX payloads, which are used to optimize bandwidth usage in remote desktop sessions, the software fails to adequately verify the success status of the decompression operation. Instead of checking for all failure conditions or null pointer returns resulting from a failed decompression attempt, the code only explicitly rejects negative return values indicating specific error codes. This narrow scope allows scenarios where the decompressor might succeed technically but produce an empty or null output buffer due to malformed input data, which is then passed directly into subsequent processing functions without further integrity checks.
The technical core of this flaw lies in how Stream_StaticConstInit handles its inputs. When a malicious RDP server sends a specially crafted ZGFX payload designed to trigger a zero-output condition during decompression, the application proceeds to initialize static stream structures with null pointers. This action violates internal assumptions about data validity and memory safety within the graphics pipeline. Because the client does not validate that the output buffer is non-null before proceeding, it attempts to operate on invalid memory references or empty streams. This logical oversight creates a direct path for denial of service attacks, as the subsequent operations relying on this corrupted state will inevitably fail, causing the FreeRDP client process to abort unexpectedly.
From an operational perspective, this vulnerability allows any RDP server that supports the RDPGFX channel to terminate active remote desktop sessions remotely. An attacker does not need authentication or elevated privileges; they simply need to be able to send data over the established connection after session activation. The impact is a complete disruption of service for the client user, leading to lost work and interrupted productivity. In environments where FreeRDP is used as part of larger infrastructure automation or persistent remote access solutions, such abrupt terminations can cause cascading failures in dependent services that rely on stable connectivity. This aligns with CWE-20 Improper Input Validation, as the application fails to verify that user-controlled input results in a valid state before processing it further.
The exploitation vector for this vulnerability is classified under MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically involving resource exhaustion or logic-based crashes rather than traditional buffer overflows. By sending minimal but malformed ZGFX packets, an attacker can induce high-level application failures without requiring complex payload construction or privilege escalation. This makes the vulnerability particularly dangerous in public-facing remote desktop gateways where automated scanning tools might inadvertently trigger these conditions during reconnaissance phases, leading to service instability even if no malicious intent is present beyond probing for vulnerabilities.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.32.2 or later, where this logic error has been corrected by implementing comprehensive checks on decompression results and ensuring null pointers are never passed to stream initialization functions. For organizations unable to patch immediately due to compatibility constraints, network-level controls such as deep packet inspection firewalls can be configured to detect anomalous ZGFX traffic patterns indicative of exploitation attempts. Additionally, administrators should enforce strict access control lists for RDP servers to limit exposure to trusted networks only, reducing the attack surface available to potential adversaries seeking to disrupt remote desktop services through this specific channel vulnerability.