UBUNTU-CVE-2026-121389: Low severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal StreamSeek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which clients are exposed to this denial of service?

FreeRDP clients in versions 3.27.0 through before 3.32.2 are affected when device redirection, TRACE logging, and WinPR assertions are enabled. The issue is triggered by connecting to a malicious RDP server.

What does an attacker need to do to trigger the issue?

An attacker must operate or control an RDP server that a user connects to. The server sends a malformed RDPDR device-list announcement with a DeviceDataLength larger than the received packet, causing a fatal Stream_Seek assertion.

Is a default FreeRDP configuration known to be affected?

The available information identifies three required conditions: device redirection, TRACE logging, and WinPR assertions must be enabled. It does not state whether these settings are enabled by default.

What can be done if updating is not immediately possible?

Avoid connecting affected clients to untrusted RDP servers. Where operationally possible, disable device redirection, TRACE logging, or WinPR assertions, since the described trigger requires all three to be enabled.

UBUNTU-CVE-2026-121389: Low severity ubuntu/freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to this denial of service?

What does an attacker need to do to trigger the issue?

Is a default FreeRDP configuration known to be affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this denial of service?

What does an attacker need to do to trigger the issue?

Is a default FreeRDP configuration known to be affected?

What can be done if updating is not immediately possible?