CVE-2026-121409

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A denial of service issue exists where malicious servers or unauthenticated peers can cause clients or proxies to crash. This occurs when oversized X.224 routing tokens are processed. Specifically, an attacker can send an oversized LoadBalanceInfo within a Server Redirection PDU or a token between 240 and 247 bytes to a FixedTarget freerdp-proxy, which triggers a tpdu write header() assertion and crashes the process.

Recommendations Update to version 3.32.2 or later.