CVE-2026-121401

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A denial of service issue exists where the rdg process packet() function dispatches a PKT TYPE EXTENDED AUTH MSG without verifying the negotiated mode or authentication context. A malicious or compromised RD Gateway can send an extended-auth packet before tunnel authentication, triggering a null-pointer dereference—a condition where the software attempts to read a memory location that is null—which results in a client crash.

Recommendations Update to version 3.32.2 or later.