CVE-2026-121407
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116654 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-116653 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-121240 Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121242 Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed… CWE-20
- CVE-2026-121236 Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121163 Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121115 Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20