CVE-2026-121410

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending a specially crafted graphics pipeline command with zero surface dimensions. Because the client fails to validate these empty dimensions, an internal assertion failure or division-by-zero error occurs, terminating the client session and crashing the application.

This vulnerability is rated as Moderate rather than Important because it only causes a client-side denial of service, without enabling remote code execution, privilege escalation, or data exfiltration. In typical Red Hat Enterprise Linux environments, FreeRDP operates as a user-space client application, meaning exploitation requires a user to actively establish an RDP connection to an untrusted or compromised external server. An attacker controlling the remote endpoint can terminate the client process by supplying invalid graphical surface dimensions, impacting only the availability of the current remote desktop session without affecting the underlying host operating system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.