CVE-2026-121951: FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
Published Nov 4, 2026
·Updated
FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.
Affected Software
5 affected componentsFixes available
debian/freerdp2*
debian/freerdp3*
debian/freerdp3<3.32.2+dfsg-1
3.32.2+dfsg-1
debian/freerdp2<=2.11.7+dfsg1-6~deb12u1
debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3
3.32.2+dfsg-13.33.0+dfsg-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Nov 4, 2026
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software