Medium severity5.9NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026

CVE-2026-121409

Description

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.

Affected products

Freerdp/Freerdpllm-fuzzy
Range: <3.32.2

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3hf9-w6hr-hf9jnvdVendor Advisory
www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-oversized-x-224-routing-tokennvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000