CVE-2026-121962
Description
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) or memory corruption by sending fragmented responses during Early User Authorization (EUA) authentication. Because FreeRDP fails to properly track remaining buffer space across partial network reads, incoming data advances past the allocated memory boundaries. An attacker who successfully exploits this issue triggers an out-of-bounds memory write, crashing the client application.
Statement
Red Hat rates this vulnerability as Important because an attacker-controlled remote desktop server can trigger heap memory corruption or terminate the client process upon connection, presenting a high risk to client integrity and availability rather than a lower-severity transient failure. Successful exploitation requires user interaction to initiate a session to an untrusted or compromised endpoint capable of completing CredSSP negotiation. In Red Hat enterprise environments, FreeRDP primarily functions as an interactive client utility or backend for desktop graphical applications, which limits the blast radius strictly to the invoking user's local execution environment.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure FreeRDP validates remaining stream buffer space rather than overall buffer capacity during partial network reads in transport_default_read_pdu: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which track remaining stream buffer capacity instead of overall capacity before advancing the write pointer during partial reads, closing fragmented Early User Authorization responses sent as partial network reads. Until patched, this is a concern on FreeRDP client deployments connecting to remote RDP servers, so Restrict users from initiating RDP connections to untrusted or unverified endpoints capable of negotiating PROTOCOL_HYBRID_EX CredSSP. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap buffer overflow defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
