CVE-2026-121411

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending oversized display scaling dimensions to a connected client. Because the client application fails to properly bound and validate these server-supplied coordinates, processing the malformed data triggers internal assertion failures that terminate the client session unexpectedly.

This vulnerability is rated as having Low severity because exploitation is restricted to a client-side denial of service and requires a user to establish a session with an untrusted or compromised RDP host. In Red Hat environments where FreeRDP is used to connect to graphical remote desktops, a malicious server can trigger an assertion failure that abruptly terminates the client process. The flaw does not allow remote code execution, privilege escalation, or unauthorized data exposure on the client system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.