Is CVE-2026-121402 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121402?

CVE-2026-121402 has a CVSS v3 severity of MEDIUM (6.5).

What does CVE-2026-121402 affect?

CVE-2026-121402 affects freerdp.

Back

CVE-2026-121402

Monitor on ThreatCluster

Description

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.