CVE-2026-121402

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its primary display buffer without closing the connection, leading to an unhandled crash when attempting to render the subsequent update.

A flaw was found in FreeRDP. A remote attacker controlling an RDP server can cause a connected FreeRDP client to crash via a crafted zero-width graphics reset that triggers a NULL pointer dereference, resulting in a denial of service. The user must connect to an attacker-controlled server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.