DEBIAN-CVE-2026-121401: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients that connect through an RD Gateway are exposed if they process gateway packets from a malicious or compromised gateway. The affected Debian package families listed are freerdp2 and freerdp3.
What does an attacker need to do to trigger the crash?
The attacker needs control of, or the ability to send packets as, the RD Gateway. They can send a PKT_TYPE_EXTENDED_AUTH_MSG before tunnel authentication, causing a null-pointer dereference in the client.
Is user interaction required?
Yes. The supplied severity vector indicates user interaction is required. The client must be induced to connect through the malicious or compromised RD Gateway.
What is the impact?
The issue causes a denial of service by crashing the FreeRDP client. The provided impact metrics indicate no confidentiality or integrity impact, with availability impact limited to the vulnerable component.