CVE-2026-121394: FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder

Q: Who can exploit this issue?

An attacker must control an RDP server that a vulnerable FreeRDP client connects to. No authentication or local privileges are required, but user interaction is required because the client must initiate the connection.

Q: What is the impact on an affected client?

A malicious server can send a crafted RemoteFX tileset containing RLGR code 32767, causing an assertion failure in rfx_rlgr_decode and terminating the FreeRDP client. The provided information describes a denial of service only, with no confidentiality or integrity impact.

Q: Which versions are affected?

FreeRDP versions from 3.11.0 up to, but not including, 3.32.2 are affected. The listed software includes Debian freerdp2 and freerdp3 packages, but no package-specific fixed versions are provided.

Published Nov 3, 2026

Updated

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfxrlgrdecode and crashing the client.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp>=3.11.0<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must control an RDP server that a vulnerable FreeRDP client connects to. No authentication or local privileges are required, but user interaction is required because the client must initiate the connection.

What is the impact on an affected client?

A malicious server can send a crafted RemoteFX tileset containing RLGR code 32767, causing an assertion failure in rfx_rlgr_decode and terminating the FreeRDP client. The provided information describes a denial of service only, with no confidentiality or integrity impact.

Which versions are affected?

FreeRDP versions from 3.11.0 up to, but not including, 3.32.2 are affected. The listed software includes Debian freerdp2 and freerdp3 packages, but no package-specific fixed versions are provided.

CVE-2026-121394: FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact on an affected client?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact on an affected client?

Which versions are affected?