PT-2026-136168

CVE-2026-121411

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description An issue exists where the software fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs. This allows a malicious RDP server to abort X11 clients by mapping a surface to oversized scaled output, which triggers checked UINT16 cast or freerdp image scale stride assertion failures that terminate the client.

Recommendations Update to version 3.32.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2026-121411