GHSA-3pg4-5r42-wxvj: FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server process.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via OSV·03:33 PM

Data Sourced

via OSV·03:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

The affected deployment is a FreeRDP shadow server with Network Level Authentication (NLA) enabled. The issue affects versions before 3.32.2.

Does an attacker need credentials or user interaction?

No. An unauthenticated attacker can trigger the issue remotely by sending a crafted CredSSP TSRequest, and no user interaction is required.

What is the practical impact of successful exploitation?

The crafted request triggers a fatal WINPR_ASSERT, causing the shadow server process to abort. The stated impact is denial of service.

What should be prioritized if remediation is not immediately possible?

Prioritize limiting network access to NLA-enabled FreeRDP shadow servers, since exploitation is network-reachable and does not require authentication. The provided information does not describe any additional workaround.

GHSA-3pg4-5r42-wxvj: FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does an attacker need credentials or user interaction?

What is the practical impact of successful exploitation?

What should be prioritized if remediation is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does an attacker need credentials or user interaction?

What is the practical impact of successful exploitation?

What should be prioritized if remediation is not immediately possible?