CVE-2026-121406

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a specially crafted graphics payload that decompresses to zero bytes. Because the client fails to account for empty output data before initializing its internal stream buffer, an internal check fails, causing the client application to crash and terminate the active session.

This vulnerability is rated as Moderate impact because exploitation is limited to a client-side denial of service and requires an active connection to an untrusted or compromised remote desktop server. In typical Red Hat Enterprise Linux environments, FreeRDP is executed as an interactive client utility rather than a persistent network service, limiting the blast radius strictly to the termination of the user's remote desktop session. Host integrity and confidentiality remain intact, as the issue results in an application abort without enabling code execution or data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.