UBUNTU-CVE-2026-121410: Medium severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker operating a malicious RDP server can exploit it against a FreeRDP client that connects to that server. No attacker privileges are required, but user interaction is required because the client must initiate or proceed with an RDP connection to the malicious server.

What is the practical impact on an affected client?

The crafted RDPGFX WIRETOSURFACE_2 PDU can trigger an assertion failure or division by zero, terminating the FreeRDP client session. The reported impact is denial of service; no confidentiality or integrity impact is listed.

Which Ubuntu FreeRDP packages should be reviewed?

The affected software listing includes ubuntu/freerdp, ubuntu/freerdp2, and ubuntu/freerdp3. FreeRDP versions before 3.32.2 are described as vulnerable.

UBUNTU-CVE-2026-121410: Medium severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected client?

Which Ubuntu FreeRDP packages should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected client?

Which Ubuntu FreeRDP packages should be reviewed?