CVE-2026-121411 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical input validation failure within the Remote Desktop Graphics (RDPGFX) subsystem, specifically affecting the handling of MAPSURFACETOSCALEDOUTPUT Protocol Data Units. This flaw stems from an insufficient boundary check on server-supplied parameters that define target dimensions and output origins. In standard RDP operations, these PDUs are used to instruct the client how to map a graphical surface onto a scaled display area. The security defect arises because the application fails to rigorously validate whether the requested scaling factors or coordinate offsets exceed safe computational limits before processing them for rendering purposes. This lack of validation allows an attacker controlling a malicious RDP server to craft specific PDUs that contain oversized values, thereby exploiting the client's assumption that incoming data will always fall within expected integer ranges.
From a technical perspective, the core issue involves improper type casting and assertion handling during image scaling operations. When the FreeRDP client processes these malformed PDUs, it attempts to cast large unsigned 16-bit integers (UINT16) or calculate strides for image buffers without verifying that the resulting values will fit within allocated memory structures. This leads directly to checked UINT16 cast failures or assertion errors related to freerdp_image_stride calculations. Instead of gracefully rejecting the invalid input, the software triggers a fatal error condition in its debugging or safety mechanisms. Consequently, this results in an immediate termination of the X11 client process on Linux-based systems. The vulnerability effectively transforms a graphical rendering function into a vector for denial-of-service attacks against remote desktop clients that rely on FreeRDP as their backend engine.
The operational impact of this vulnerability is significant for organizations relying on free and open-source RDP solutions, particularly in environments where users connect to untrusted or compromised servers. An attacker can exploit this flaw by simply establishing an RDP connection and sending the malicious MAPSURFACETOSCALEDOUTPUT PDU sequence. The result is a complete crash of the client application, leading to service disruption for the end-user. While this does not currently allow for remote code execution due to the nature of the assertion failures causing termination rather than memory corruption exploitation, it severely undermines the availability and reliability of the remote desktop infrastructure. In high-availability scenarios or kiosk environments where uninterrupted graphical sessions are critical, such crashes can cause substantial operational downtime and require manual intervention to restore service.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to verify that user-controlled input meets expected constraints before processing it. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with techniques observed in Denial of Service attacks where attackers target specific software components to disrupt service availability. The exploitation path involves sending crafted network packets (T1490) that trigger internal application faults. To mitigate this risk, administrators must ensure that all FreeRDP clients are updated to version 3.32.2 or later, which includes the necessary patches for bounding these dimensions and origins properly. Additionally, deploying network-level authentication and restricting RDP access to trusted servers can reduce the attack surface by preventing untrusted entities from initiating sessions capable of triggering this flaw.