UBUNTU-CVE-2026-121401: Medium severity ubuntu/freerdp vulnerability
Published Nov 3, 2026
·Updated
FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.
Affected Software
9 affected components
ubuntu/freerdp*
ubuntu/freerdp2*
ubuntu/freerdp*
ubuntu/freerdp2*
ubuntu/freerdp2*
ubuntu/freerdp3*
ubuntu/freerdp2*
ubuntu/freerdp3*
ubuntu/freerdp3*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Nov 3, 2026
CVE Published
via OSV·03:17 PM
Data Sourced
via OSV·03:17 PM
DescriptionSeverityAffected Software