CVE-2026-121409
Analyzed Analyzed - Analysis Complete

Denial of Service in FreeRDP via X.224 Routing Token Overflow

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121409
EUVD
EUVD-2026-115941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in FreeRDP versions before 3.32.2. Attackers can crash clients or proxies by sending oversized X.224 routing tokens, such as a LoadBalanceInfo in a Server Redirection PDU or a 240–247 byte token to a FixedTarget freerdp-proxy. This triggers a tpdu_write_header assertion, causing the process to terminate.

Detection Guidance

Monitor FreeRDP processes for crashes or assertion failures. Check network traffic for oversized LoadBalanceInfo in Server Redirection PDUs or tokens of 240–247 bytes sent to proxies. Use packet capture tools like tcpdump or Wireshark to inspect X.224 routing tokens in RDP traffic.

Impact Analysis

This vulnerability can lead to service disruption by crashing FreeRDP clients or proxies, resulting in loss of availability for remote desktop sessions. Attackers may exploit it remotely without authentication, potentially affecting systems using vulnerable FreeRDP versions.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later. If upgrading is not possible, apply patches from FreeRDP's security advisory. For proxies, disable FixedTarget or implement token length validation to reject tokens exceeding 247 bytes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...