CVE-2026-121389

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.27.0 through 3.32.1

Description A denial of service issue exists in the rdpdr dump packet() function. A malicious RDP server can cause clients to abort by sending malformed RDPDR device-list announcements. This occurs when an attacker specifies a DeviceDataLength that exceeds the actual received packet, which triggers a fatal Stream Seek assertion. This condition is met when device redirection, TRACE logging, and WinPR assertions are enabled.

Recommendations Update FreeRDP to version 3.32.2 or later.