UBUNTU-CVE-2026-121951: High severity ubuntu/freerdp vulnerability

Published Nov 4, 2026

Updated

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service.

Affected Software

2 affected components

ubuntu/freerdp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote RDP client must have an active session with the affected FreeRDP server. The issue can be triggered by sending a truncated slow-path input event with an unknown message type.

What is the impact of successful exploitation?

Exploitation can cause a WinPR stream assertion failure that aborts assertion-enabled server processes, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.

Which versions are affected?

FreeRDP versions from 3.0.0 before 3.32.2 are affected.

UBUNTU-CVE-2026-121951: High severity ubuntu/freerdp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions are affected?