CVE-2026-121390

A flaw was found in FreeRDP. A malicious remote gateway can cause a Denial of Service (DoS) by returning a crafted response that omits an expected server certificate field. FreeRDP fails to properly validate the missing field during Azure Active Directory (AAD) gateway communications, leading to an assertion failure that crashes the client process.

This vulnerability is rated as Moderate severity because exploitation results solely in a client-side denial of service without compromising system confidentiality or integrity. To trigger the flaw, an attacker must operate or compromise a Remote Desktop gateway to which a client connects. Because the impact is strictly limited to an unexpected client process crash and cannot be leveraged for arbitrary code execution or privilege escalation, the blast radius is constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.