Skip to content
OpenAdvisories
Low WID-SEC-2026-4015 4 CVEs

FreeRDP: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 18, 2026 · Updated Nov 9, 2026 · Revision 3 · de

Vendor: Ubuntu Product: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

FreeRDP ist eine freie Implementierung des Remote Desktop Protocol (RDP).

Vulnerabilities 4

  • Medium 4.3
    CVE-2026-121403

    FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP

    FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumula…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2026-121410

    FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

    FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering a…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 3.1
    CVE-2026-121389

    FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging

    FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the r…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 3.1
    CVE-2026-121411

    FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry

    FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked U…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Ubuntu aufgenommen

  2. #2

    Referenz(en) aufgenommen: CVE-2026-121411, EUVD-2026-115943, CVE-2026-121410, EUVD-2026-115942, CVE-2026-121389, EUVD-2026-115921, CVE-2026-121403, EUVD-2026-115935

  3. #1

    Initiale Fassung

References