CVE-2026-121389
LOW
freerdp
NVD
CVSS Score
3.1
Severity
LOW
Published
Nov 03, 2026
Vendor
freerdp
Description
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.