CVE-2026-121411

LowCVSS 3.1/10Last modified Nov 9, 2026

Description

FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	< 3.32.2

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wffv-rjv2-h2x2Vendor Advisory
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-abort-via-rdpgfx-scaled-output-geometryThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wffv-rjv2-h2x2Vendor Advisory

Timeline

Published: Nov 3, 2026
Last modified: Nov 9, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1214126.5FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain CVE-2026-1214133.1Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates CVE-2026-1214145.9Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation CVE-2026-1214153.7Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowi CVE-2026-1214167.1SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because Meth CVE-2026-1214177.8SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affin CVE-2026-1214184.3SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field value CVE-2026-1214198.1SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access m CVE-2026-121427.2The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Pa CVE-2026-1214203.3SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fai CVE-2026-1214214.3SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --den CVE-2026-1214224.1SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific d