CVE-2026-121402

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A NULL pointer dereference occurs when a malicious RDP server sends a zero-width RDPGFX ResetGraphics PDU. This causes a failed resize in the gdi resize ex() function, which leaves the primary display null without ending the session. Consequently, a subsequent bitmap update triggers a crash in the gdi Bitmap Paint() function.

Recommendations Update to version 3.32.2 or later.