DEBIAN-CVE-2026-121411: Low severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdpimagescale stride assertion failures that terminate the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of FreeRDP X11 clients are exposed when they connect to a malicious RDP server that sends crafted RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs. The listed affected Debian packages are freerdp3 and freerdp2.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that a user connects to and have that server send oversized scaled-output dimensions or output-origin values. Exploitation requires user interaction because the client must connect to the malicious server.
What is the impact of successful exploitation?
The malicious server can terminate the FreeRDP X11 client through a checked UINT16 cast failure or a freerdp_image_scale stride assertion failure. The provided data describes an availability impact only, not confidentiality or integrity impact.
Which versions contain the fix?
FreeRDP versions before 3.32.2 are affected. Version 3.32.2 or later contains the stated bound checks for server-supplied target dimensions and output origin.