DEBIAN-CVE-2026-121406: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfxondatareceived rejects only negative zgfxdecompress status and passes the resulting null output pointer to StreamStaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP clients using versions before 3.32.2 are exposed when they connect to an attacker-controlled or malicious RDP server. The affected Debian package names listed are freerdp3 and freerdp2.
What does an attacker need to trigger the issue?
The attacker needs to operate or control an RDP server that the client connects to. After session activation, the server can send a zero-output ZGFX payload on the RDPGFX channel to trigger the client assertion abort.
What is the security impact?
The issue causes client termination, resulting in a low availability impact. The provided severity vector indicates no confidentiality or integrity impact.