CVE-2026-121410
Analyzed Analyzed - Analysis Complete

FreeRDP Denial of Service via Zero Surface Dimensions

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121410
EUVD
EUVD-2026-115942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.2 has a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler. A malicious RDP server can send a crafted PDU with zero width and height, causing an assertion failure or division by zero that terminates the client session.

Detection Guidance

Monitor FreeRDP client logs for assertion failures or crashes during RDP sessions. Check for network traffic containing WIRETOSURFACE_2 PDUs with zero width and height. Use Wireshark to filter RDPGFX protocol traffic for malformed packets.

Impact Analysis

This vulnerability allows an attacker to terminate your FreeRDP client session by sending a specially crafted packet. It requires you to connect to a server controlled by the attacker with RDPGFX enabled. No memory corruption or code execution has been demonstrated.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later. Disable RDPGFX if not required. Block untrusted RDP servers. Monitor for suspicious RDP traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...