CVE-2026-121408

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) by crashing the client application. The issue is caused by a race condition leading to a use-after-free memory error in the USB redirection component when the server sends a close request while the client is announcing a connected USB device.

This vulnerability is rated as Moderate severity because it requires establishing a connection to an untrusted or compromised RDP server and specifically depends on active USB redirection, primarily causing a client application crash. In typical Red Hat Enterprise Linux environments, USB device redirection is not enabled by default and requires explicit configuration when initiating an RDP session. The blast radius is restricted to the local user's RDP client process without impacting host system integrity or other user sessions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not enable USB device redirection when initiating FreeRDP connections. Ensure that invocation scripts or connection parameters do not include USB forwarding options (such as /usb). Additionally, restrict connections exclusively to trusted remote desktop servers.

Caveats: Omitting USB redirection flags prevents local USB peripherals from being accessible inside the remote session.