CVE-2026-121393
MEDIUM
freerdp
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
freerdp
Description
FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.