CVE-2026-121407

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A denial of service issue exists in the shadow server's remdesk server thread function. Authenticated clients can crash the process by exploiting an inverted PDU (Protocol Data Unit) length check. By sending an 8192-byte remdesk payload that declares an eight-byte PDU length, an attacker can trigger a fatal Stream Seek assertion, which aborts the server and drops all active sessions.

Recommendations Update to version 3.32.2 or later.