CVE-2026-121960
Description
A flaw was found in FreeRDP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted Credential Security Support Provider (CredSSP) request that omits negotiation tokens. When processing this malformed request with Network Level Authentication (NLA) enabled, the server triggers an internal assertion failure that abruptly terminates the server process and drops active client sessions.
Statement
This vulnerability is rated as having an Important severity impact because an unauthenticated remote attacker can trigger an immediate server process termination without credentials or user interaction, resulting in a complete denial of service for active remote sessions. Within Red Hat Enterprise Linux environments, FreeRDP packages are primarily utilized for client-side remote desktop connectivity, and the shadow server utility is neither enabled nor executed by default. The risk is therefore confined to deployments where administrators explicitly run the shadow server with Network Level Authentication enabled and expose its listening port to untrusted networks.
Mitigation
Restrict network exposure of the FreeRDP shadow server to trusted hosts or terminate the shadow server service if remote desktop sharing is not required.
1. If the shadow server is running and not needed, terminate the `freerdp-shadow-cli` process.
2. If the service must be accessible, restrict incoming connections to authorized management networks using firewalld:
firewall-cmd --permanent --zone=public --remove-port=3389/tcp
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR>
firewall-cmd --reload
Caveat: Restricting network access prevents unauthenticated remote clients from connecting to the shadow server session. Replace the port number if a non-default port was specified.
Warning: Reloading firewall rules with `firewall-cmd --reload` may temporarily disrupt active network traffic.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to isolate the FreeRDP shadow server network boundary by restricting incoming traffic to authorized management hosts or terminating freerdp-shadow-cli: upgrade to FreeRDP 3.32.2+ (or the fixed Freerdp builds), which validates CredSSP TSRequest structures to ensure missing negoTokens do not pass a null buffer to WinPrAsn1Decoder_InitMem and trigger fatal WINPR_ASSERT aborts, closing crafted CredSSP TSRequest containing only the version field and omitting negoTokens. Until patched, this is a concern on deployments running the FreeRDP shadow server with Network Level Authentication enabled and assertions active, so terminate the freerdp-shadow-cli process if desktop sharing is not required, or restrict the listening port via firewall rules strictly to trusted management IP addresses. These controls limit blast radius and contain exploitation, but they do not fix the underlying reachable assertion failure defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the assert() extends beyond the attacker's own session. For example, if a server handles multiple simultaneous connections, if an assert() occurs in one single connection that causes all other connections to be dropped, this could be a significant denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
