CVE-2026-121389
Description
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending a malformed Device Redirection (RDPDR) announcement. Under configurations where diagnostic trace logging and assertions are active, processing the invalid data length triggers an assertion failure, causing the FreeRDP client to crash.
Statement
This vulnerability is rated as having Low severity because triggering the issue requires specific diagnostic logging and assertion configurations that are disabled by default in standard Red Hat enterprise builds, and the impact is limited to crashing the client application. Under default deployment conditions, production binaries do not operate with active trace logging or assertion-abort behaviors enabled during device redirection. Furthermore, exploitation necessitates that a user intentionally establishes an RDP session with an untrusted remote endpoint, restricting the blast radius strictly to client-side denial of service without compromising system integrity or confidentiality.
Mitigation
1. Disable diagnostic TRACE logging:
Ensure diagnostic tracing is disabled in the shell environment before launching client connections:
unset WLOG_LEVEL
2. Restrict device redirection:
Omit device redirection arguments (such as `/drive:`, `/printer:`, or `/smartcard:`) when connecting to unverified or untrusted remote endpoints.
Caveats:
Disabling device redirection prevents sharing local peripherals and filesystems with the remote session. Disabling trace logging reduces diagnostic visibility during troubleshooting. If client sessions are spawned by a persistent desktop helper service, restarting the application or session is required for environment changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | N/A | 3.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the assert() extends beyond the attacker's own session. For example, if a server handles multiple simultaneous connections, if an assert() occurs in one single connection that causes all other connections to be dropped, this could be a significant denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
