CVE-2026-121402: FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics

Q: Which clients are exposed to this issue?

The affected component is the X11 client, xfreerdp, in FreeRDP versions before 3.32.2. Clients are exposed when they connect to a malicious RDP server that can send the crafted RDPGFX messages.

Q: Does exploitation require credentials or user interaction?

The vector is network-based and requires no privileges on the client. A user must initiate or maintain a connection to a malicious RDP server for that server to deliver the malicious PDU.

Q: What is the practical impact of exploitation?

A malicious server can cause the xfreerdp client to crash, producing a denial of service. The provided information identifies no confidentiality or integrity impact.

Q: What should be done if an upgrade is not immediately possible?

The provided information does not identify a configuration workaround. Limit connections to trusted RDP servers until FreeRDP can be updated to version 3.32.2 or later.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdiBitmapPaint.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which clients are exposed to this issue?

The affected component is the X11 client, xfreerdp, in FreeRDP versions before 3.32.2. Clients are exposed when they connect to a malicious RDP server that can send the crafted RDPGFX messages.

Does exploitation require credentials or user interaction?

The vector is network-based and requires no privileges on the client. A user must initiate or maintain a connection to a malicious RDP server for that server to deliver the malicious PDU.

What is the practical impact of exploitation?

A malicious server can cause the xfreerdp client to crash, producing a denial of service. The provided information identifies no confidentiality or integrity impact.

What should be done if an upgrade is not immediately possible?

The provided information does not identify a configuration workaround. Limit connections to trusted RDP servers until FreeRDP can be updated to version 3.32.2 or later.

CVE-2026-121402: FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to this issue?

Does exploitation require credentials or user interaction?

What is the practical impact of exploitation?

What should be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this issue?

Does exploitation require credentials or user interaction?

What is the practical impact of exploitation?

What should be done if an upgrade is not immediately possible?