# CVE-2026-121951: FreeRDP server denial of service in RDP peer input parsing

Source: https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121951 · Severity: high · CVSS 7.5 · Published 2026-11-04

FreeRDP is a remote desktop protocol server that allows users to access systems remotely. A remote attacker with an active RDP session can send a malformed input event that causes assertion-enabled server processes to crash, disrupting service to all connected clients. This requires an established session but no authentication bypass; the impact is denial of service only.

Technologies: [FreeRDP Project FreeRDP](https://junglewise.ai/threats/technologies/freerdp-project-freerdp). Vendors: [FreeRDP Project](https://junglewise.ai/threats/vendors/freerdp-project).

## Quick answers

**Is CVE-2026-121951 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121951 being exploited in the wild.

**How severe is CVE-2026-121951?** High severity, with a CVSS score of 7.5, published 4 November 2026.

**Which products and versions are affected?** FreeRDP Project FreeRDP 3.0.0 through 3.32.1.

**Is there a fix for CVE-2026-121951?** Yes: fixed in 3.32.2. Until then: Disable assertions in production builds by defining NDEBUG or setting WITH_VERBOSE_WINPR_ASSERT=OFF at compile time. This prevents the process abort, though a fatal error is still logged; alternatively, require NLA (Network Level Authentication) to add an authentication barrier before clients reach the active session state. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121951 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121951?** Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

Disable assertions in production builds by defining NDEBUG or setting WITH_VERBOSE_WINPR_ASSERT=OFF at compile time. This prevents the process abort, though a fatal error is still logged; alternatively, require NLA (Network Level Authentication) to add an authentication barrier before clients reach the active session state.

## Technical details

The vulnerability exists in the slow-path input event parser, which skips six bytes for unknown message types without verifying those bytes remain within the packet's declared length. This causes the stream cursor to advance past the sealed packet boundary, triggering a WinPR assertion failure that terminates the process. The attack requires an active RDP session (post-authentication) and only impacts builds with active assertions (WITH_VERBOSE_WINPR_ASSERT=ON or assertions enabled).

## Affected products

- FreeRDP Project FreeRDP 3.0.0 through 3.32.1

## Timeline

- 2026-10-20: disclosed
- 2026-11-04: advisory
- 2026-11-04: patched

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qq4-qwxq-49m8)
- [https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-slow-path-input-event](https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-slow-path-input-event)

## Related threats

- [FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in)
- [FreeRDP use-after-free in DRDYNVC tracker race condition](https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in)
- [FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference)
- [FreeRDP memory exhaustion in RD Gateway packet handling](https://junglewise.ai/threats/cve-2026-121399-freerdp-before-3-32-2-contains-a-memory-allocation-vulnerability)