Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-121389: FreeRDP client can be forced to crash by bad device list
CVE-2026-121389 · published 1 day ago
Summary
Versions of FreeRDP from 3.27.0 up to but not including 3.32.2 may stop working when a malicious remote desktop server sends a malformed device‑list announcement. The problem can cause the client program to close unexpectedly, disrupting a user session. Upgrade to FreeRDP 3.32.2 or later, or disable device redirection and detailed logging if an upgrade is not immediately possible.
What to do
- Update debian freerdp3 to version 3.32.2+dfsg-1.
- Update freerdp freerdp to version 3.32.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | freerdp | freerdp |
< 3.32.2 >= 3.27.0, < 3.32.2 |
| Debian:12 | debian | freerdp2 | All versions |
| Debian:13 | debian | freerdp3 | All versions |
| Debian:14 | debian | freerdp3 |
< 3.32.2+dfsg-1 Fix: upgrade to 3.32.2+dfsg-1
|
Original advisory text
FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-66mr-7wc7-23vc Vendor Advisory
- https://www.vulncheck.com/advisories/freerdp-3.27.0-before-3.32.2-client-dos-via... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-1213... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-121389 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-121389 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-617Reachable Assertion
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-121389 · NVD
CVE-2026-121389 · MITRE
CVE-2026-121389 · OSV
GHSA-66mr-7wc7-23vc · GHSA
DEBIAN-CVE-2026-121389 · OSV
Track software like this
Free during beta