CVE-2026-121390: FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response

Q: Which deployments are exposed?

FreeRDP versions from 3.0.0 before 3.32.2 are affected only when built with WITH_AAD=ON. The listed software includes Debian freerdp2, Debian freerdp3, and FreeRDP freerdp.

Q: What does an attacker need to exploit this issue?

An attacker needs to operate or control a gateway that a user selects. The gateway must return an ARM response with a missing or non-string redirectedServerCert field, and user interaction is required because the user must select that gateway.

Q: What is the impact of successful exploitation?

The malformed gateway response can trigger a reachable assertion and abort the FreeRDP client process. The provided vector indicates availability impact only, with no confidentiality or integrity impact.

Q: What should be prioritized for remediation?

Update affected FreeRDP installations to 3.32.2 or later. Systems not built with WITH_AAD=ON are not described as affected.

Published Nov 3, 2026

Updated

FreeRDP 3.0.0 before 3.32.2 built with WITHAAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp>=3.0.0<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

FreeRDP versions from 3.0.0 before 3.32.2 are affected only when built with WITH_AAD=ON. The listed software includes Debian freerdp2, Debian freerdp3, and FreeRDP freerdp.

What does an attacker need to exploit this issue?

An attacker needs to operate or control a gateway that a user selects. The gateway must return an ARM response with a missing or non-string redirectedServerCert field, and user interaction is required because the user must select that gateway.

What is the impact of successful exploitation?

The malformed gateway response can trigger a reachable assertion and abort the FreeRDP client process. The provided vector indicates availability impact only, with no confidentiality or integrity impact.

What should be prioritized for remediation?

Update affected FreeRDP installations to 3.32.2 or later. Systems not built with WITH_AAD=ON are not described as affected.

CVE-2026-121390: FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be prioritized for remediation?