Is CVE-2026-121394 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121394?

CVE-2026-121394 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-121394

Description

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.