CVE-2026-121407: FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal StreamSeek assertion, aborting the server and dropping sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client able to interact with the FreeRDP shadow server's remdesk channel can trigger the denial of service. The supplied data does not indicate that unauthenticated attackers can exploit it.
What is required to trigger the crash?
The attacker sends an 8192-byte remdesk payload that declares an eight-byte PDU length. This reaches an inverted PDU length check and triggers a fatal Stream_Seek assertion.
What is the operational impact of successful exploitation?
The shadow server process aborts, causing a denial of service and dropping active sessions. The provided CVSS vector indicates no confidentiality or integrity impact.
Which versions should be remediated?
FreeRDP versions before 3.32.2 are affected according to the supplied advisory data. Listed software includes FreeRDP and the Debian freerdp2 and freerdp3 packages.