CVE-2026-121960: FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

Q: Which deployments are exposed to this denial of service?

The affected component is the NLA-enabled FreeRDP shadow server. The provided data identifies FreeRDP versions before 3.32.2 and Debian freerdp2 and freerdp3 packages as affected software.

Q: Does an attacker need credentials or user interaction to trigger the issue?

No. An unauthenticated attacker can trigger the flaw remotely without user interaction by sending a crafted CredSSP TSRequest.

Q: What malformed input triggers the server failure?

A seven-byte CredSSP TSRequest containing only the version field and omitting negoTokens triggers a fatal WINPR_ASSERT. This aborts the shadow server process, resulting in denial of service.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server process.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial of service?

The affected component is the NLA-enabled FreeRDP shadow server. The provided data identifies FreeRDP versions before 3.32.2 and Debian freerdp2 and freerdp3 packages as affected software.

Does an attacker need credentials or user interaction to trigger the issue?

No. An unauthenticated attacker can trigger the flaw remotely without user interaction by sending a crafted CredSSP TSRequest.

What malformed input triggers the server failure?

A seven-byte CredSSP TSRequest containing only the version field and omitting negoTokens triggers a fatal WINPR_ASSERT. This aborts the shadow server process, resulting in denial of service.

CVE-2026-121960: FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does an attacker need credentials or user interaction to trigger the issue?

What malformed input triggers the server failure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does an attacker need credentials or user interaction to trigger the issue?

What malformed input triggers the server failure?