UBUNTU-CVE-2026-121406: Medium severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 allows a client assertion abort because rdpgfxondatareceived rejects only negative zgfxdecompress status and passes the resulting null output pointer to StreamStaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using FreeRDP as an RDP client are exposed when they connect to an untrusted or malicious RDP server. The affected behavior is in handling RDPGFX channel data after the RDP session has been activated; the issue affects FreeRDP versions before 3.32.2.

What must an attacker do to trigger the denial of service?

An attacker needs to operate or control an RDP server that the client connects to. After session activation, the server can send a zero-output ZGFX payload on the RDPGFX channel, causing the client to terminate through an assertion abort.

UBUNTU-CVE-2026-121406: Medium severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the denial of service?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the denial of service?