CVE-2026-121389 — Vulnerability intelligence
freerdp — freerdp
Published:
- CVSS
- 2.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.