CVE-2026-121406

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description An issue exists where the rdpgfx on data received function only rejects negative zgfx decompress status values, leading to a null output pointer being passed to Stream StaticConstInit. This allows a malicious RDP server to terminate the client by sending a zero-output ZGFX payload on the RDPGFX channel after session activation, resulting in a client assertion abort.

Recommendations Update FreeRDP to version 3.32.2 or later.