Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121411— FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry

Quick assessment

Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 3.32.2 版本之前的 FreeRDP 中，未能对 RDPGFX MAPSURFACETOSCALEDOUTPUT 协议数据单元（PDU）中由服务器提供的目标尺寸和输出原点进行边界检查。这使得恶意的 RDP 服务器能够导致 X11 客户端异常终止。攻击者可将表面映射到尺寸过大的缩放输出，从而触发受检查的 UINT16 类型转换或 freerdp_image_scale 步幅断言失败，最终造成客户端崩溃。

CVSS 3.1 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121411

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FreeRDP FreeRDP 0 ~ 3.32.2 -

II. Public POCs for CVE-2026-121411

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121411

请登录查看更多情报信息。

Other References for CVE-2026-121411 (2)

Same Patch Batch · FreeRDP · 2026-11-03 · 27 CVEs total

CVE-2026-121386 7.5 HIGH FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
CVE-2026-121392 7.4 HIGH FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
CVE-2026-121395 6.5 MEDIUM FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder
CVE-2026-121400 6.5 MEDIUM FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
CVE-2026-121404 6.5 MEDIUM FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
CVE-2026-121412 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
CVE-2026-121407 6.5 MEDIUM FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
CVE-2026-121393 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion
CVE-2026-121402 6.5 MEDIUM FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
CVE-2026-121394 6.5 MEDIUM FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder
CVE-2026-121388 6.5 MEDIUM FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST
CVE-2026-121409 5.9 MEDIUM FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
CVE-2026-121398 5.9 MEDIUM FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
CVE-2026-121408 5.3 MEDIUM FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
CVE-2026-121401 4.3 MEDIUM FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet
CVE-2026-121403 4.3 MEDIUM FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
CVE-2026-121405 4.3 MEDIUM FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control
CVE-2026-121406 4.3 MEDIUM FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload
CVE-2026-121387 4.3 MEDIUM FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder
CVE-2026-121390 4.3 MEDIUM FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: FreeRDP
Same vendor: FreeRDP
Same weakness: CWE-20