DEBIAN-CVE-2026-121402: Null Pointer Dereference
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdiBitmapPaint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of xfreerdp clients from FreeRDP versions before 3.32.2 are exposed when they connect to a malicious RDP server. The affected Debian packages listed are freerdp3 and freerdp2.
What must an attacker do to trigger the crash?
An attacker needs to operate or control an RDP server that the user connects to. The server sends a zero-width RDPGFX ResetGraphics PDU, then a later bitmap update causes the xfreerdp client to crash.
What is the impact of successful exploitation?
Successful exploitation causes a denial of service by crashing the xfreerdp client. The provided data does not indicate confidentiality or integrity impact.