CVE-2026-121402

MediumCVSS 6.5/10Last modified Nov 7, 2026

Description

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	< 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfgVendor Advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphicsThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfgVendor Advisory

Timeline

Published: Nov 3, 2026
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1214034.3FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE bod CVE-2026-1214046.5FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server t CVE-2026-1214054.3FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger exces CVE-2026-1214064.3FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passe CVE-2026-1214076.5FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clie CVE-2026-1214085.3FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer with CVE-2026-1214095.9FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or CVE-2026-121414.9The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-1214104.3FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero sur CVE-2026-1214113.1FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing m CVE-2026-1214126.5FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain CVE-2026-1214133.1Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates