CVE-2026-121394
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120956 The MongoDB C Driver does not validate the type or format of a namespace field returned… CWE-617
- CVE-2026-121409 FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious… CWE-617
- CVE-2026-121406 FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received… CWE-617
- CVE-2026-121396 FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a… CWE-617
- CVE-2026-121395 FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX… CWE-617
- CVE-2026-121389 FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in… CWE-617
- CVE-2026-121390 FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because… CWE-617
- CVE-2026-121393 FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows… CWE-617