CVE-2026-121409

A flaw was found in FreeRDP. This vulnerability allows a malicious server or an unauthenticated remote peer to cause a Denial of Service (DoS) by sending an oversized connection routing token. When the client or proxy processes this oversized data during connection negotiation, an internal validation failure causes the application process to terminate unexpectedly.

This vulnerability is rated as Moderate impact because exploitation causes an application crash resulting in denial of service, without impacting host confidentiality or integrity. Within Red Hat Enterprise Linux deployments, FreeRDP is primarily used as a client application and underlying library for outbound remote desktop sessions. Successful exploitation requires a user to establish a session with a malicious or compromised remote endpoint that returns specially crafted routing tokens.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.