DEBIAN-CVE-2026-121407: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal StreamSeek assertion, aborting the server and dropping sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client that can interact with the FreeRDP shadow server's remdesk functionality can trigger the denial of service. The supplied vector indicates network reachability, low attack complexity, and low privileges required.
What is the impact of a successful attack?
The attack aborts the shadow server process through a fatal Stream_Seek assertion. This drops active sessions and causes a denial of service; no confidentiality or integrity impact is indicated.
What input triggers the crash?
The attacker sends an 8192-byte remdesk payload that declares an eight-byte PDU length. The inverted PDU length check then leads to the fatal assertion.
Which versions are affected?
FreeRDP versions before 3.32.2 are affected. The listed Debian software entries are freerdp3 and freerdp2.