CVE-2026-121396: FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion

Q: Which deployments are exposed?

Exposure is limited to FreeRDP clients from 3.0.0 before 3.32.2 that were built with verbose WinPR assertions and connect through an RD Gateway.

Q: What does an attacker need to exploit this issue?

The attacker needs control of the RD Gateway used by the connecting client. They can then send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding.

Q: What is the practical impact on an affected client?

The crafted PDU reaches an assertion in rts_read_auth_verifier and aborts the connecting FreeRDP client process. The stated impact is denial of service, with no confidentiality or integrity impact listed.

Q: How can I determine whether a client is affected?

Check whether the client uses a FreeRDP version from 3.0.0 up to, but not including, 3.32.2, and whether it was built with verbose WinPR assertions. Affected clients are relevant when they use an RD Gateway.

Q: What can be done if an update cannot be applied immediately?

Avoid using affected clients to connect through RD Gateways that could be attacker-controlled. Updating to FreeRDP 3.32.2 or later removes the affected version range.

Published Nov 3, 2026

Updated

FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rtsreadauthverifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding to abort the connecting client process.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

Exposure is limited to FreeRDP clients from 3.0.0 before 3.32.2 that were built with verbose WinPR assertions and connect through an RD Gateway.

What does an attacker need to exploit this issue?

The attacker needs control of the RD Gateway used by the connecting client. They can then send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding.

What is the practical impact on an affected client?

The crafted PDU reaches an assertion in rts_read_auth_verifier and aborts the connecting FreeRDP client process. The stated impact is denial of service, with no confidentiality or integrity impact listed.

How can I determine whether a client is affected?

Check whether the client uses a FreeRDP version from 3.0.0 up to, but not including, 3.32.2, and whether it was built with verbose WinPR assertions. Affected clients are relevant when they use an RD Gateway.

What can be done if an update cannot be applied immediately?

Avoid using affected clients to connect through RD Gateways that could be attacker-controlled. Updating to FreeRDP 3.32.2 or later removes the affected version range.

CVE-2026-121396: FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact on an affected client?

How can I determine whether a client is affected?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact on an affected client?

How can I determine whether a client is affected?

What can be done if an update cannot be applied immediately?