CVE-2026-121401: FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet

Q: Who can exploit this issue?

An attacker must control or compromise the RD Gateway used by a FreeRDP client. The gateway can send a crafted extended-authentication packet before tunnel authentication and crash the connecting client.

Q: Are clients affected without authenticating to the gateway?

Yes. The vulnerable packet can be processed before tunnel authentication, so the crash can occur before the client has authenticated to the RD Gateway.

Q: Which versions are affected?

FreeRDP versions before 3.32.2 are affected. Updating to 3.32.2 or later addresses the issue.

Q: What is the impact on the client?

The malformed packet triggers a null-pointer dereference in the client, resulting in a denial of service through a client crash.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must control or compromise the RD Gateway used by a FreeRDP client. The gateway can send a crafted extended-authentication packet before tunnel authentication and crash the connecting client.

Are clients affected without authenticating to the gateway?

Yes. The vulnerable packet can be processed before tunnel authentication, so the crash can occur before the client has authenticated to the RD Gateway.

Which versions are affected?

FreeRDP versions before 3.32.2 are affected. Updating to 3.32.2 or later addresses the issue.

What is the impact on the client?

The malformed packet triggers a null-pointer dereference in the client, resulting in a denial of service through a client crash.

CVE-2026-121401: FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are clients affected without authenticating to the gateway?

Which versions are affected?

What is the impact on the client?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are clients affected without authenticating to the gateway?

Which versions are affected?

What is the impact on the client?