CVE-2026-121394

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafted graphics stream. This triggers an internal assertion failure in the decoder, causing the client application to terminate abruptly.

A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted packet triggering an assertion failure in the RemoteFX decoder, resulting in a denial of service. The user must connect to an attacker-controlled server and RemoteFX must be enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.