CVE-2026-121393

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.32.1

Description A denial of service issue exists where malicious RDP servers can terminate clients built with verbose WinPR assertions. This occurs when the server sends crafted RemoteFX region rectangles, specifically by setting the x coordinate to 65535 while the SurfaceBits destination is left of 1. This sequence triggers a 16-bit coordinate assertion within the rfx process message() function, causing the client process to abort.

Recommendations Update FreeRDP to version 3.32.2.