CVE-2026-121389

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending a malformed Device Redirection (RDPDR) announcement. Under configurations where diagnostic trace logging and assertions are active, processing the invalid data length triggers an assertion failure, causing the FreeRDP client to crash.

This vulnerability is rated as having Low severity because triggering the issue requires specific diagnostic logging and assertion configurations that are disabled by default in standard Red Hat enterprise builds, and the impact is limited to crashing the client application. Under default deployment conditions, production binaries do not operate with active trace logging or assertion-abort behaviors enabled during device redirection. Furthermore, exploitation necessitates that a user intentionally establishes an RDP session with an untrusted remote endpoint, restricting the blast radius strictly to client-side denial of service without compromising system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

1. Disable diagnostic TRACE logging: Ensure diagnostic tracing is disabled in the shell environment before launching client connections:

unset WLOG_LEVEL

2. Restrict device redirection: Omit device redirection arguments (such as /drive:, /printer:, or /smartcard:) when connecting to unverified or untrusted remote endpoints.

Caveats: Disabling device redirection prevents sharing local peripherals and filesystems with the remote session. Disabling trace logging reduces diagnostic visibility during troubleshooting. If client sessions are spawned by a persistent desktop helper service, restarting the application or session is required for environment changes to take effect.