CVE-2026-121960

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

CVE-2026-121960

FreeRDP versions prior to 3.32.2 are vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. The issue exists in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens . An unauthenticated attacker can trigger a fatal WINPR_ASSERT and abort the server process by s...

EUVD-2026-116960

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

CVE-2026-121960 FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

PT-2026-137012

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR ASSERT and abort the server...

CVE-2026-121960: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP…

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

CVE-2026-121407

A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted message to the shadow server's remdesk virtual channel. Due to an inverted packet length verification check, processing the malformed data triggers an internal assertion...

CVE-2026-121407

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fata...

DEBIAN-CVE-2026-121404

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

CVE-2026-121404

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

EUVD-2026-115939

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fata...

CVE-2026-121407

FreeRDP versions before 3.32.2 are susceptible to a denial of service vulnerability within the shadow server's remdesk_server_thread . The root cause is an inverted PDU length check that occurs when an authenticated client sends a specific 8192-byte remdesk payload declaring only an eight-byte PD...

CVE-2026-121404 FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

CVE-2026-121404 FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

CVE-2026-121404

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

EUVD-2026-115936

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...

CVE-2026-121404

FreeRDP versions before 3.32.2 are vulnerable to a denial of service (DoS) vulnerability in the shadow server . The issue arises because the FreeRDP_WTSVirtualChannelRead function fails to consume zero-length drdynvc DATA PDUs sent on opened audin or rdpgfx channels. Consequently, an authenticate...

freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch

A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potential...

CVE-2026-121407: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that…

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fata...

CVE-2026-121404: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP…

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that...