CVE-2026-121951

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.32.1

Description Server-side RDP peer input parsing fails to verify if the six-byte body of a slow-path input event with an unknown message type is within the packet's declared length. This leads to a WinPR stream assertion failure. A remote RDP client with an active session can exploit this by sending a truncated unknown input event to abort assertion-enabled server processes, resulting in a denial of service.

Recommendations Update FreeRDP to version 3.32.2.