Is CVE-2026-121395 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121395?

CVE-2026-121395 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-121395

Description

FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.