CVE-2026-121395

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending crafted RemoteFX graphic data to a connecting client. When processing the malformed display tiles with verbose assertions enabled, an unexpected value in the differential decoder causes an assertion failure that terminates the client application.

This vulnerability is rated as Moderate impact for Red Hat environments because successful exploitation is limited to a client-side denial of service and requires an active session to a rogue endpoint. On standard Red Hat Enterprise Linux installations, production binaries are compiled without verbose debugging assertions, substantially mitigating exposure during regular use. Additionally, the flaw only causes abnormal termination of the affected client process without risking arbitrary code execution or confidentiality compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.