CVE-2026-121410: FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

Q: Who is exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious RDP server. The server can send the crafted RDPGFX ALPHA WIRETOSURFACE_2 PDU during the session.

Q: What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a vulnerable FreeRDP client connects to. No client-side privileges are required, but user interaction is required because the client must initiate or accept the connection.

Q: What is the impact of successful exploitation?

The crafted PDU can trigger an assertion failure or division by zero, terminating the FreeRDP client session. The provided information describes an availability impact only, with no confidentiality or integrity impact.

Q: What can be done if an upgrade is not immediately possible?

Avoid connecting vulnerable FreeRDP clients to untrusted or attacker-controlled RDP servers. The provided information does not identify a configuration workaround or mitigation beyond updating to version 3.32.2 or later.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients before 3.32.2 are exposed when they connect to a malicious RDP server. The server can send the crafted RDPGFX ALPHA WIRETOSURFACE_2 PDU during the session.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a vulnerable FreeRDP client connects to. No client-side privileges are required, but user interaction is required because the client must initiate or accept the connection.

What is the impact of successful exploitation?

The crafted PDU can trigger an assertion failure or division by zero, terminating the FreeRDP client session. The provided information describes an availability impact only, with no confidentiality or integrity impact.

What can be done if an upgrade is not immediately possible?

Avoid connecting vulnerable FreeRDP clients to untrusted or attacker-controlled RDP servers. The provided information does not identify a configuration workaround or mitigation beyond updating to version 3.32.2 or later.

CVE-2026-121410: FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if an upgrade is not immediately possible?