CVE-2026-121394
MEDIUM
freerdp
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
freerdp
Description
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.