CVE-2026-121389
Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in FreeRDP via Malformed RDPDR Device-List

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121389
EUVD
EUVD-2026-115921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.27.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in FreeRDP versions 3.27.0 to 3.32.1. A malicious RDP server can send a malformed RDPDR device announcement with a DeviceDataLength exceeding the packet size. This triggers a fatal Stream_Seek assertion in the rdpdr_dump_packet function, causing the client to abort. The attack requires device redirection, TRACE logging, and WinPR assertions to be enabled.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP client versions and enabling specific logging. Use 'xfreerdp --version' to verify if your client is between 3.27.0 and 3.32.1. Enable RDPDR TRACE logging by setting the environment variable 'WLOG_TRACE=rdpdr=trace' before launching FreeRDP. Monitor logs for 'Stream_Seek' assertion errors during RDP sessions.

Impact Analysis

The impact is limited to a denial of service where the FreeRDP client crashes and aborts. It does not lead to data disclosure, modification, memory corruption, or code execution. The attack requires specific conditions to be met, reducing the likelihood of exploitation.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later immediately. Disable device redirection if not required by setting '/drive:*' or specific device options to 'none' in RDP commands. Disable TRACE logging and WinPR assertions in builds if possible. Block untrusted RDP servers at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...