DEBIAN-CVE-2026-121409: High severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpduwriteheader assertion that crashes the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
FreeRDP clients and proxies are exposed when they process malicious server redirection data. FixedTarget freerdp-proxy deployments are specifically affected by a 240–247 byte routing token.
What does an attacker need to do to trigger the crash?
A malicious server or unauthenticated peer must send crafted X.224 routing data. This can be an oversized LoadBalanceInfo in a Server Redirection PDU, or the specified token length against a FixedTarget freerdp-proxy.
What is the practical impact of successful exploitation?
The crafted routing token triggers a tpdu_write_header assertion, causing the affected client or proxy process to crash. The documented impact is denial of service.
Which versions should be considered affected?
FreeRDP versions before 3.32.2 are affected according to the available data. The listed Debian software packages are freerdp3 and freerdp2.