PT-2026-136163
CVE-2026-121406
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx on data received rejects only negative zgfx decompress status and passes the resulting null output pointer to Stream StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
Found an issue in the description? Have something to add? Feel free to write us 👾