CVE-2026-121406
Analyzed Analyzed - Analysis Complete

FreeRDP Client Assertion Abort via ZGFX Zero-Output Payload

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121406
EUVD
EUVD-2026-115938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a client-side denial of service (DoS) flaw in FreeRDP versions before 3.32.2. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation. The client's decompression function incorrectly returns success while leaving the output pointer null, causing an assertion abort in Stream_StaticConstInit and terminating the client.

Detection Guidance

Monitor FreeRDP client crashes during RDP sessions, particularly after session activation. Check for assertion aborts in logs when processing ZGFX payloads. Use network traffic analysis tools like Wireshark to inspect RDPGFX channel traffic for zero-output ZGFX payloads (e.g., three bytes E0 20 00 or seven bytes E1 00 00 00 00 00 00).

Enable verbose WinPR assertions in FreeRDP builds to detect assertion failures during ZGFX payload processing.

Impact Analysis

The impact is limited to denial of service, meaning the FreeRDP client will crash and become unavailable. No memory corruption, data disclosure, or code execution occurs. The attack requires network access and can be triggered without user interaction.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to address the vulnerability. If upgrading is not immediately possible, restrict network access to FreeRDP clients or disable the RDPGFX channel as a temporary workaround.

Monitor incoming RDP connections for malformed ZGFX payloads using intrusion detection systems or network monitoring tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...