CVE-2026-121951
Description
A flaw was found in FreeRDP. In server-side input parsing, the application skips the body of an unknown input event without verifying that the data remains within the declared packet length. A remote attacker with an active session can send a crafted, truncated input event, triggering an internal assertion failure that terminates the server process and causes a Denial of Service (DoS).
Statement
This vulnerability is rated Important because a remote client can trigger an unhandled process abort, resulting in a complete denial of service across active sessions on the server process. In standard Red Hat Enterprise Linux environments, FreeRDP packages are primarily utilized for client-side remote desktop connectivity, which remains unaffected by this server-side defect. Exposure is limited to configurations that explicitly run FreeRDP server instances or shadow services reachable by untrusted clients.
Mitigation
Restrict exposure by limiting RDP network traffic to trusted hosts or subnets using firewalld:
1. Add the trusted administrative subnet to the trusted zone:
firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
2. Remove general access to the RDP port (default 3389/tcp) from public zones:
firewall-cmd --permanent --zone=public --remove-port=3389/tcp
3. Apply the firewall configuration:
firewall-cmd --reload
Warning: Reloading firewall rules may briefly interrupt active network sessions.
Additionally, stop any running `freerdp-shadow-cli` or custom FreeRDP server processes if remote session sharing is not actively required.
Caveat: Network access controls mitigate untrusted exposure but do not defend against malicious input sent by authorized clients within the permitted network.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate remaining stream length before advancing stream pointers in FreeRDP server-side slow-path input parsing: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which verify remaining packet length before seeking past the six-byte body of an unknown input event, closing truncated slow-path input event with unknown message type. Until patched, this is only a concern on configurations running FreeRDP server instances or shadow services compiled with active WinPR assertions — client-side FreeRDP connections are unaffected — so restrict network access to RDP listening ports to trusted hosts using firewall rules or disable running freerdp-shadow-cli and custom server processes. These controls limit blast radius and contain exploitation, but they do not fix the underlying reachable assertion failure defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the assert() extends beyond the attacker's own session. For example, if a server handles multiple simultaneous connections, if an assert() occurs in one single connection that causes all other connections to be dropped, this could be a significant denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
