DEBIAN-CVE-2026-121395: Medium severity debian/freerdp2 vulnerability
FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Who can trigger the crash?
A malicious RDP server can trigger it against a connecting FreeRDP client. Exploitation requires the user to initiate or interact with an RDP connection to that server.
Are all affected FreeRDP installations vulnerable by default?
The assertion failure is described as occurring when verbose WinPR assertions are enabled. The provided data does not state whether that setting is enabled by default.
What is the impact of successful exploitation?
A crafted RemoteFX tile can abort the FreeRDP client process, resulting in a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
Which versions are affected?
FreeRDP versions from 3.17.0 up to, but not including, 3.32.2 are affected. The listed Debian software packages are freerdp3 and freerdp2.