CVE-2026-121409: FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

Q: Which deployments are exposed to this issue?

FreeRDP clients and proxies running versions before 3.32.2 are exposed when they process attacker-controlled X.224 routing information. The described proxy-specific path affects FixedTarget freerdp-proxy deployments.

Q: What does an attacker need to do to trigger the crash?

An attacker can act as a malicious server or unauthenticated peer. They must send either an oversized LoadBalanceInfo value in a Server Redirection PDU or, for a FixedTarget freerdp-proxy, a routing token between 240 and 247 bytes.

Q: What is the impact of successful exploitation?

The malformed routing token triggers a tpdu_write_header assertion, aborting and crashing the affected client or proxy process. The reported impact is denial of service; no confidentiality or integrity impact is described.

Q: How can I determine whether an instance is affected?

Check whether the deployment uses FreeRDP before version 3.32.2. For freerdp-proxy, also determine whether it is configured with FixedTarget routing, which is the configuration identified for the 240–247 byte token attack path.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpduwriteheader assertion that crashes the process.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP clients and proxies running versions before 3.32.2 are exposed when they process attacker-controlled X.224 routing information. The described proxy-specific path affects FixedTarget freerdp-proxy deployments.

What does an attacker need to do to trigger the crash?

An attacker can act as a malicious server or unauthenticated peer. They must send either an oversized LoadBalanceInfo value in a Server Redirection PDU or, for a FixedTarget freerdp-proxy, a routing token between 240 and 247 bytes.

What is the impact of successful exploitation?

The malformed routing token triggers a tpdu_write_header assertion, aborting and crashing the affected client or proxy process. The reported impact is denial of service; no confidentiality or integrity impact is described.

How can I determine whether an instance is affected?

Check whether the deployment uses FreeRDP before version 3.32.2. For freerdp-proxy, also determine whether it is configured with FixedTarget routing, which is the configuration identified for the 240–247 byte token attack path.

CVE-2026-121409: FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

How can I determine whether an instance is affected?