DEBIAN-CVE-2026-121389: Low severity debian/freerdp2 vulnerability
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal StreamSeek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients in the affected version range are exposed when device redirection, TRACE logging, and WinPR assertions are enabled. The issue is triggered while processing RDPDR device-list announcements from an RDP server.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to operate or control an RDP server that a client connects to and send a malformed RDPDR device-list announcement. The announcement declares a DeviceDataLength larger than the received packet, causing a fatal Stream_Seek assertion.
What is the practical impact on an affected client?
The malicious server can cause the FreeRDP client to abort, resulting in a denial of service. The available data does not describe confidentiality or integrity impact.
How can I tell whether my FreeRDP installation is in the affected upstream range?
The described affected range is FreeRDP 3.27.0 through versions before 3.32.2. The provided data identifies Debian freerdp3 and freerdp2 packages but does not provide package-specific fixed versions.