CVE-2026-121389: FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging

Q: Which clients are exposed to this denial of service?

Clients running affected FreeRDP versions are exposed when device redirection, TRACE logging, and WinPR assertions are enabled. The attack is delivered by a malicious RDP server during RDPDR device-list announcement handling.

Q: What must an attacker do to trigger the crash?

An attacker needs to operate or control an RDP server that the client connects to and send a malformed RDPDR device-list announcement. The announcement declares a DeviceDataLength larger than the received packet, causing a fatal Stream_Seek assertion under the affected configuration.

Q: Is a default FreeRDP configuration known to be affected?

The provided information does not establish that default configurations are affected. Exploitation specifically requires device redirection, TRACE logging, and WinPR assertions to be enabled.

Published Nov 3, 2026

Updated

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal StreamSeek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp>=3.27.0<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

Which clients are exposed to this denial of service?

Clients running affected FreeRDP versions are exposed when device redirection, TRACE logging, and WinPR assertions are enabled. The attack is delivered by a malicious RDP server during RDPDR device-list announcement handling.

What must an attacker do to trigger the crash?

An attacker needs to operate or control an RDP server that the client connects to and send a malformed RDPDR device-list announcement. The announcement declares a DeviceDataLength larger than the received packet, causing a fatal Stream_Seek assertion under the affected configuration.

Is a default FreeRDP configuration known to be affected?

The provided information does not establish that default configurations are affected. Exploitation specifically requires device redirection, TRACE logging, and WinPR assertions to be enabled.

CVE-2026-121389: FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to this denial of service?

What must an attacker do to trigger the crash?

Is a default FreeRDP configuration known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this denial of service?

What must an attacker do to trigger the crash?

Is a default FreeRDP configuration known to be affected?