CVE-2026-121406: FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload

Q: Who is exposed to this issue?

FreeRDP clients running a version before 3.32.2 are exposed when they connect to a malicious RDP server. The issue affects the client rather than the server being connected to.

Q: What must an attacker do to trigger the denial of service?

An attacker must operate or control an RDP server that the victim connects to. After session activation, the server sends a zero-output ZGFX payload on the RDPGFX channel, causing the client to abort.

Q: Is user interaction required?

Yes. A user must initiate an RDP connection to the malicious server; no client-side privileges are required by the attacker.

Q: What is the immediate mitigation if upgrading is not possible?

Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers. This prevents a malicious server from delivering the triggering RDPGFX payload.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 allows a client assertion abort because rdpgfxondatareceived rejects only negative zgfxdecompress status and passes the resulting null output pointer to StreamStaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients running a version before 3.32.2 are exposed when they connect to a malicious RDP server. The issue affects the client rather than the server being connected to.

What must an attacker do to trigger the denial of service?

An attacker must operate or control an RDP server that the victim connects to. After session activation, the server sends a zero-output ZGFX payload on the RDPGFX channel, causing the client to abort.

Is user interaction required?

Yes. A user must initiate an RDP connection to the malicious server; no client-side privileges are required by the attacker.

What is the immediate mitigation if upgrading is not possible?

Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers. This prevents a malicious server from delivering the triggering RDPGFX payload.

CVE-2026-121406: FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the denial of service?

Is user interaction required?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the denial of service?

Is user interaction required?

What is the immediate mitigation if upgrading is not possible?