Is CVE-2026-121407 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121407?

CVE-2026-121407 has a CVSS v3 severity of MEDIUM (6.5).

What does CVE-2026-121407 affect?

CVE-2026-121407 affects freerdp.

Back

CVE-2026-121407

Monitor on ThreatCluster

Description

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.