Assertion abort in FreeRDP client via zero-output ZGFX payload
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.
Summary
FreeRDP before 3.32.2 allows a client assertion abort (CWE-617) because the client does not reject a ZGFX decompression result with zero output. A malicious RDP server can send such a payload on the RDPGFX channel after session activation to terminate the client. The attack needs no privileges, and the impact is limited to availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update FreeRDP to version 3.32.2, which fixes this issue. Red Hat lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as affected without a fix, with no fix planned for Red Hat Enterprise Linux 6 and no fix currently available for the others.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA FreeRDP (FreeRDP) Fixed in 3.32.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
FreeRDP 3.32.2
27 records Highest priority Priority HIGH 3 HIGH, 11 MEDIUM, 13 LOW
Other records, highest priority first
- TI-2026-84268 Denial of service in FreeRDP WinPR PNG and JPEG image readersPriority HIGH 77
- TI-2026-84291 Denial of service in FreeRDP via oversized X.224 routing tokenPriority HIGH 69
- TI-2026-84280 Use-after-free in FreeRDP dyn-channel-dump modulePriority HIGH 69
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121406
- 2026-11-03 Alias added: GHSA-9fvr-q6q4-7h2p
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: LOW → MEDIUM
References
More Freerdp vulnerabilities
- TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
- TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
- TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
- TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
- TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
- TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-121406 · CVE Program
- CVE-2026-121406 · NVD
- FIRST EPSS
- GHSA-9fvr-q6q4-7h2p · GitHub Advisory Database · CC BY 4.0
- CVE-2026-121406 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences