CVE-2026-121390

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.32.1

Description When built with WITH AAD=ON, the ARM gateway response parser fails to properly validate the redirectedServerCert field. If this field is missing or is not a string, the parser passes a null buffer to the certificate parser, triggering a reachable assertion. A malicious or malformed user-selected gateway can exploit this behavior to abort the client process.

Recommendations Update FreeRDP to version 3.32.2 or later.